tcg/riscv: Fix illegal shift instructions
authorZihao Yu <yuzihao@ict.ac.cn>
Wed, 16 Dec 2020 08:12:06 +0000 (16:12 +0800)
committerRichard Henderson <richard.henderson@linaro.org>
Mon, 4 Jan 2021 16:32:58 +0000 (06:32 -1000)
commitd2f3066eb2af5d6867974493833834e2aaa427f7
tree9f8a17d475181cdbca11a33c0654bef0181e1dbe
parent6d3ef04893bdea3e7aa08be3cce5141902836a31
tcg/riscv: Fix illegal shift instructions

Out-of-range shifts have undefined results, but must not trap.
Mask off immediate shift counts to solve this problem.

This bug can be reproduced by running the following guest instructions:

  xor %ecx,%ecx
  sar %cl,%eax
  cmovne %edi,%eax

After optimization, the tcg opcodes of the sar are

  movi_i32 tmp3,$0xffffffffffffffff  pref=all
  sar_i32 tmp3,eax,tmp3              dead: 2  pref=all
  mov_i32 cc_dst,eax                 sync: 0  dead: 1 pref=0xffc0300
  mov_i32 cc_src,tmp3                sync: 0  dead: 0 1  pref=all
  movi_i32 cc_op,$0x31               sync: 0  dead: 0  pref=all

The sar_i32 opcode is a shift by -1, which unmasked generates

  0x200808d618:  fffa5b9b          illegal

Signed-off-by: Zihao Yu <yuzihao@ict.ac.cn>
Message-Id: <20201216081206.9628-1-yuzihao@ict.ac.cn>
[rth: Reworded the patch description.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
tcg/riscv/tcg-target.c.inc