assert !temp_readonly(ts) in tcg_reg_alloc_op

assert !temp_readonly(ts) in tcg_reg_alloc_op

[Nicholas Piggin]

I get a crash running a powerpc64 TCG machine on x86.

It can be triggered by booting a custom vmlinux patched to use powerpc
prefix instructions and pcrel addressing, I don't know if that's related
or coincidence. I can give Linux patches or a vmlinux file to reproduce
if needed, or I can test patches quickly.

The first bad commit is 7058ff5231a0 ("target/ppc: Avoid tcg_const_* in
translate.c")

Some gdb stuff

  0x00007ffff76d5395 in __assert_fail_base
    (fmt=0x7ffff7849a70 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55555625a99c "!temp_readonly(ts)", file=file@entry=0x555556256211 "../tcg/tcg.c", line=line@entry=4450, function=function@entry=0x55555625b640 <__PRETTY_FUNCTION__.9> "tcg_reg_alloc_op") at ./assert/assert.c:92
#5  0x00007ffff76e3df2 in __GI___assert_fail
    (assertion=0x55555625a99c "!temp_readonly(ts)", file=0x555556256211 "../tcg/tcg.c", line=4450, function=0x55555625b640 <__PRETTY_FUNCTION__.9> "tcg_reg_alloc_op") at ./assert/assert.c:101
#6  0x0000555555e078b9 in tcg_reg_alloc_op
    (s=0x7ffd60000b70, op=0x7ffd600097f8) at ../tcg/tcg.c:4450
#7  0x0000555555e08e77 in tcg_gen_code
    (s=0x7ffd60000b70, tb=0x7fffb07612c0, pc_start=13835058055286387916)
    at ../tcg/tcg.c:5122
#8  0x0000555555e49a3f in setjmp_gen_code
    (env=0x555556be9e30, tb=0x7fffb07612c0, pc=13835058055286387916, host_pc=0x7ffd702074cc, max_insns=0x7ffff65076ac, ti=0x7ffff65076c8)
    at ../accel/tcg/translate-all.c:297
#9  0x0000555555e49c67 in tb_gen_code
    (cpu=0x555556be7a40, pc=13835058055286387916, cs_base=0, flags=3053453367, cflags=-16777216) at ../accel/tcg/translate-all.c:365
#10 0x0000555555e40db4 in cpu_exec_loop (cpu=0x555556be7a40, sc=0x7ffff6507800)
    at ../accel/tcg/cpu-exec.c:978
#11 0x0000555555e40f95 in cpu_exec_setjmp
    (cpu=0x555556be7a40, sc=0x7ffff6507800) at ../accel/tcg/cpu-exec.c:1043
#12 0x0000555555e4101c in cpu_exec (cpu=0x555556be7a40)
    at ../accel/tcg/cpu-exec.c:1069

(gdb) frame 6
#6  0x0000555555e078b9 in tcg_reg_alloc_op (s=0x7ffd60000b70,
    op=0x7ffd600097f8) at ../tcg/tcg.c:4450
4450	            tcg_debug_assert(!temp_readonly(ts));
(gdb) p *op
$1 = {opc = INDEX_op_divu2_i32, nargs = 5, param1 = 0, param2 = 0,
  life = 464, link = {tqe_next = 0x7ffd60009840, tqe_circ = {
      tql_next = 0x7ffd60009840, tql_prev = 0x7ffd60009770}}, output_pref = {
    0, 4}, args = 0x7ffd60009818}
(gdb) print *def
$2 = {name = 0x55555625baf5 "divu2_i32", nb_oargs = 2 '\002',
  nb_iargs = 3 '\003', nb_cargs = 0 '\000', nb_args = 5 '\005',
  flags = 0 '\000', args_ct = 0x555556ba793c}
(gdb) p k
$3 = 1
(gdb) p *ts
$4 = {reg = TCG_REG_R12, val_type = TEMP_VAL_CONST, base_type = TCG_TYPE_I32,
  type = TCG_TYPE_I32, kind = TEMP_CONST, indirect_reg = 0, indirect_base = 0,
  mem_coherent = 0, mem_allocated = 0, temp_allocated = 1, temp_subindex = 0,
  val = 0, mem_base = 0x0, mem_offset = 0, name = 0x0, state = 0,
  state_ptr = 0x7ffd6000a9fc}
(gdb) p *arg_ct
$5 = {ct = 0, alias_index = 3, sort_index = 1, pair_index = 0, pair = 0,
  oalias = true, ialias = false, newreg = false, regs = 4}

Thanks,
Nick

Re: assert !temp_readonly(ts) in tcg_reg_alloc_op

[Nicholas Piggin]

On Fri Apr 7, 2023 at 7:02 PM AEST, Nicholas Piggin wrote:
> I get a crash running a powerpc64 TCG machine on x86.
>
> It can be triggered by booting a custom vmlinux patched to use powerpc
> prefix instructions and pcrel addressing, I don't know if that's related
> or coincidence. I can give Linux patches or a vmlinux file to reproduce
> if needed, or I can test patches quickly.
>
> The first bad commit is 7058ff5231a0 ("target/ppc: Avoid tcg_const_* in
> translate.c")

This seems to do the trick:

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 9d05357d03..23869fe6cb 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -1807,8 +1807,8 @@ static inline void gen_op_arith_modw(DisasContext *ctx, TCGv ret, TCGv arg1,
         TCGv_i32 t2 = tcg_constant_i32(1);
         TCGv_i32 t3 = tcg_constant_i32(0);
         tcg_gen_movcond_i32(TCG_COND_EQ, t1, t1, t3, t2, t1);
-        tcg_gen_remu_i32(t3, t0, t1);
-        tcg_gen_extu_i32_tl(ret, t3);
+        tcg_gen_remu_i32(t1, t0, t1);
+        tcg_gen_extu_i32_tl(ret, t1);
     }
 }

Re: assert !temp_readonly(ts) in tcg_reg_alloc_op

[Richard Henderson]

On 4/7/23 03:24, Nicholas Piggin wrote:
> On Fri Apr 7, 2023 at 7:02 PM AEST, Nicholas Piggin wrote:
>> I get a crash running a powerpc64 TCG machine on x86.
>>
>> It can be triggered by booting a custom vmlinux patched to use powerpc
>> prefix instructions and pcrel addressing, I don't know if that's related
>> or coincidence. I can give Linux patches or a vmlinux file to reproduce
>> if needed, or I can test patches quickly.
>>
>> The first bad commit is 7058ff5231a0 ("target/ppc: Avoid tcg_const_* in
>> translate.c")
> 
> This seems to do the trick:
> 
> diff --git a/target/ppc/translate.c b/target/ppc/translate.c
> index 9d05357d03..23869fe6cb 100644
> --- a/target/ppc/translate.c
> +++ b/target/ppc/translate.c
> @@ -1807,8 +1807,8 @@ static inline void gen_op_arith_modw(DisasContext *ctx, TCGv ret, TCGv arg1,
>           TCGv_i32 t2 = tcg_constant_i32(1);
>           TCGv_i32 t3 = tcg_constant_i32(0);
>           tcg_gen_movcond_i32(TCG_COND_EQ, t1, t1, t3, t2, t1);
> -        tcg_gen_remu_i32(t3, t0, t1);
> -        tcg_gen_extu_i32_tl(ret, t3);
> +        tcg_gen_remu_i32(t1, t0, t1);
> +        tcg_gen_extu_i32_tl(ret, t1);

Yes, that's the correct sort of fix.
Nit: slightly better as

     tcg_gen_remu_i32(ret, t0, t1);
     tcg_gen_extu_i32_tl(ret, ret);

where the no-op extu will not be emitted at all for ppc32.


r~