<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: Ubuntu 22.04 <!-- Windows 10 21H1, Fedora 37, etc. --> - OS/kernel version: Linux lin005 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux <!-- For POSIX hosts, use `uname -a` --> - Architecture: x86-64 <!-- x86, ARM, s390x, etc. --> - QEMU flavor: qemu-riscv64 <!-- qemu-system-x86_64, qemu-aarch64, qemu-img, etc. --> - QEMU version: qemu-riscv64 version 9.0.50 (v9.0.0-1123-g74abb45dac) <!-- e.g. `qemu-system-x86_64 --version` --> - QEMU command line: <!-- Give the smallest, complete command line that exhibits the problem. If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log. --> ``` ./qemu-riscv64 -L /usr/riscv64-linux-gnu/ ./test.bin ``` ## Emulated/Virtualized environment - Operating system: N/A (qemu-user) <!-- Windows 10 21H1, Fedora 37, etc. --> - OS/kernel version: N/A (qemu-user) <!-- For POSIX guests, use `uname -a`. --> - Architecture: riscv64 <!-- x86, ARM, s390x, etc. --> ## Description of problem <!-- Describe the problem, including any error/crash messages seen. --> According to the RISCV ISA manual, the froundnx.h instruction rounds a half-precision floating-point number in the source register to an integer and writes the integer, represented as a half-precision floating-point number, to the destination register. Because the values are stored in 64-bit width registers, they must be NaN-unboxed/boxed before/after the operation. When an input value lacks the proper form of NaN-boxing, it should be treated as a canonical NaN. However, when an incorrectly NaN-boxed value is passed to froundnx.h, QEMU produces 0 instead of the canonical NaN. This is because there is a typo in the definition of helper_froundnx_h: ``` // target/riscv/fpu_helper.c uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1) { float16 frs1 = check_nanbox_s(env, rs1); // This should be check_nanbox_h. frs1 = float16_round_to_int(frs1, &env->fp_status); return nanbox_h(env, frs1); } ``` ## Steps to reproduce 1. Write `test.c`. ``` #include <stdio.h> char i_F6[8] = { 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }; char o_F5[8]; void __attribute__ ((noinline)) show_state() { for (int i = 0; i < 8; i++) { printf("%02x ", o_F5[i]); } printf("\n"); } void __attribute__ ((noinline)) run() { __asm__ ( "lui t5, %hi(i_F6)\n" "addi t5, t5, %lo(i_F6)\n" "fld ft6, 0(t5)\n" ".insn 0x445372d3\n" // froundnx.h ft5, ft6 "lui t5, %hi(o_F5)\n" "addi t5, t5, %lo(o_F5)\n" "fsd ft5, 0(t5)\n" ); } int main(int argc, char **argv) { run(); show_state(); return 0; } ``` 2. Compile `test.bin` using this command: `riscv64-linux-gnu-gcc-12 -O2 -no-pie -march=rv64iv ./test.c -o ./test.bin`. 3. Run QEMU using this command: `qemu-riscv64 -L /usr/riscv64-linux-gnu/ ./test.bin`. 4. The program, runs on top of the buggy QEMU, prints `00 00 ff ff ff ff ff ff`. It should print `00 7e ff ff ff ff ff ff` after the bug is fixed. ## Additional information <!-- Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant. --> <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->