On Thu, 6 Aug 2026 at 22:37, Brian Cain <[email protected]> wrote:
>
> valid-slots: packets that legally share a slot and were wrongly
> rejected before the fix (load and transfer, load encoded first;
> dczeroa packed last with three transfers).
>
> invalid-slots: unassignable packets that must still be rejected:
> store + duplex, load + indirect jump, three logical ops competing for
> slots 2 and 3, and five ops for four slots.
>
> Reviewed-by: Matheus Tavares Bernardino <[email protected]>
> Signed-off-by: Brian Cain <[email protected]>
> ---
> tests/tcg/hexagon/invalid-slots.c | 72 +++++++++++++++++++++++++++++++
> tests/tcg/hexagon/valid-slots.c | 62 ++++++++++++++++++++++++++
> tests/tcg/hexagon/Makefile.target | 1 +
> 3 files changed, 135 insertions(+)
> create mode 100644 tests/tcg/hexagon/valid-slots.c
Hi; if you build QEMU with the clang sanitizer enabled
("--enable-ubsan --cc=clang --cxx=clang++") then the invalid-slots
test added here results in the hexagon decoder trying to shift
by -1, which is UB:
$
UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1
./build/clang/qemu-hexagon
./build/clang/tests/tcg/hexagon-linux-user-invalid-slots.test
../../target/hexagon/decode.c:603:35: runtime error: shift exponent -1
is negative
#0 0x555695dc2392 in decode_set_slot_number
/home/pm215/qemu/build/clang/../../target/hexagon/decode.c:603:35
#1 0x555695dc2392 in decode_packet
/home/pm215/qemu/build/clang/../../target/hexagon/decode.c:783:14
#2 0x5556959801e7 in decode_and_translate_packet
/home/pm215/qemu/build/clang/../../target/hexagon/translate.c:1274:18
#3 0x55569597f927 in hexagon_tr_translate_packet
/home/pm215/qemu/build/clang/../../target/hexagon/translate.c:1375:5
#4 0x5556958bda32 in translator_loop
/home/pm215/qemu/build/clang/../../accel/tcg/translator.c:216:9
#5 0x55569597ec72 in hexagon_translate_code
/home/pm215/qemu/build/clang/../../target/hexagon/translate.c:1428:5
#6 0x5556958bca00 in setjmp_gen_code
/home/pm215/qemu/build/clang/../../accel/tcg/translate-all.c:251:5
#7 0x5556958babd7 in tb_gen_code
/home/pm215/qemu/build/clang/../../accel/tcg/translate-all.c:324:21
#8 0x55569589fbfc in cpu_exec_loop
/home/pm215/qemu/build/clang/../../accel/tcg/cpu-exec.c:973:22
#9 0x55569589e309 in cpu_exec_setjmp
/home/pm215/qemu/build/clang/../../accel/tcg/cpu-exec.c:1019:12
#10 0x55569589e10d in cpu_exec
/home/pm215/qemu/build/clang/../../accel/tcg/cpu-exec.c:1050:12
#11 0x555695977cdb in cpu_loop
/home/pm215/qemu/build/clang/../../linux-user/hexagon/cpu_loop.c:38:18
#12 0x5556961fe1f5 in main
/home/pm215/qemu/build/clang/../../linux-user/main.c:1010:5
#13 0x7c65f202a1c9 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0x7c65f202a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#15 0x55569582d294 in _start
(/home/pm215/qemu/build/clang/qemu-hexagon+0x910294) (BuildId:
d18c0fb84fd3431a52be6d831fc64fd2d0e00980)
(This also shows up as "make check" failing in this config.)
Could you have a look at what goes wrong here, please?
thanks
-- PMM
