Skip to content

TCG Optimizer crashes on AArch64 SVE2 instruction

Host environment

  • Operating system: Fedora 35
  • OS/kernel version: Linux li-142ea8cc-3370-11b2-a85c-c55585c2aa0e.ibm.com 5.15.11-200.fc35.x86_64 #1 SMP Wed Dec 22 15:41:11 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
  • Architecture: x86_64
  • QEMU flavor: qemu-system-aarch64
  • QEMU version: QEMU emulator version 6.2.0 (v6.2.0) + QEMU latest master
  • QEMU command line: qemu-system-aarch64 -machine virt,secure=on -cpu max -bios reproducer.img

Emulated/Virtualized environment

  • Operating system: None
  • OS/kernel version: None
  • Architecture: ARM aarch64

Description of problem

QEMU crashes due to an assertion in the TCG optimizer when optimizing an SVE2 instruction:

Unrecognized operation 145 in do_constant_folding.
../tcg/optimize.c:458: tcg fatal error

Steps to reproduce

  1. Compile the following minimized reproducer: (a pre-compiled image is provided for convenience - reproducer.img)
.org 0x0
entry:
    mrs     x1, cptr_el3
    orr     x9, x1, #0x100
    msr     cptr_el3,   x9

    msr     cptr_el2,   xzr

    mov     x1, #0x3
    mrs     x9, cpacr_el1
    bfi     x9, x1, #16, #2
    bfi     x9, x1, #20, #2
    msr     cpacr_el1,  x9

    mov     x9, 512
    mov     x0, x9
    asr     x0, x0, 7
    sub     x9, x0, #1
    msr     zcr_el1, x9

    mov     x9, 512
    mov     x0, x9
    asr     x0, x0, 7
    sub     x9, x0, #1
    msr     zcr_el2, x9

    mov     x9, 512
    mov     x0, x9
    asr     x0, x0, 7
    sub     x9, x0, #1
    msr     zcr_el3, x9

    uqxtnt  z11.s, z22.d
  1. Execute it using the command line given above.

Additional information

I tested latest master as well, and the problem persists.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information