<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance--> ## Host environment - Operating system: Debian forky/sid - OS/kernel version: Linux 7.1.12+deb14-amd64 - Architecture: x86_64 - QEMU flavor: qemu-s390x - QEMU version: 11.x - QEMU command line: - qemu-s390x ## Description of problem In some conditions, the `sllk` instruction emulation produces wrong results, or `SIGSEGV` (because of out-of-bound access). ## Steps to reproduce 1. Compile deposit_bug.c with `s390x-linux-gnu-gcc -O2 -static -o deposit_bug deposit_bug.c` 2. Execute `qemu-s390x ./deposit_bug` and see the failures 3. Execute `qemu-s390x -one-insn-per-tb ./deposit_bug` and see the difference 4. Execute `qemu-s390x ./deposit_bug` with Qemu version \<= 10.1.3, or before commit 5f747705a45e808f159b40cd1ca59ef7c6c0a249, and see the difference The bug was found on a large code base heavily using modular arithmetic. LLM assistance (Claude Opus 5) was used to bissect the Qemu git, find the potential problematic commit (5f747705a45e808f159b40cd1ca59ef7c6c0a249), and format a minimal working bug example. Because of the tricky conditions to trigger the bug (see the memory `barrier` to force new TCG translation blocks), the LLM was used to instrument Qemu, find the exact conditions and plausible explanation of the bug. ## Additional information ```c /* * qemu-s390x: a 32-bit write into a 64-bit GPR lands in the WRONG HALF. * * s390x-linux-gnu-gcc -O2 -static -o deposit_bug deposit_bug.c * qemu-s390x ./deposit_bug # FAIL on 11.x, ok on <= 10.1.3 * * SLLK is a 32-bit shift: it writes the low 32 bits of a 64-bit GPR and leaves * the high half alone, i.e. TCG "deposit_i64 rD,rD,val,0,32". On an x86-64 host * that deposit is not directly supported, so fold_deposit() lowers it as * * extract2_i64 rD, old, val, 32 ; rD = val:old >> 32 * rotl_i64 rD, rD, 32 ; swap the halves back * * then calls fold_masks_zos() on the ROTL with the masks it computed for the * DEPOSIT. Three ingredients make those masks say "the result is exactly the * constant the register already holds": * * 1. the destination's previous value is a known constant (lghi %r11,256) * 2. the written value is NOT a constant, but its low 32 bits are exactly * known and equal to that same constant (lhi %r4,128; sllk ,1) * 3. so z_mask == o_mask == 0x100 for the deposit's result * * fold_masks_zosa_int() then does tcg_opt_gen_movi(op, rD, 0x100); rD is * already recorded as a copy of that constant, so tcg_opt_gen_mov() takes its * ts_are_copies() path and calls tcg_op_remove(): the ROTL is DELETED, not * rewritten. The extract2 inserted just before has already clobbered rD with * the half-swapped intermediate, and nothing puts it back. * * The read has to happen in a LATER translation block (hence the call to * barrier()): inside the same block the optimizer also replaces the read by the * constant it believes rD holds, and the corruption stays invisible. * * Bisected to 5f747705a45e808f159b40cd1ca59ef7c6c0a249 * "tcg/optimize: Lower unsupported deposit during optimize"; * its parent c1d5ef32e79ecc4d646d616bc23cdf7355c99c35 is good. */ #include <stdint.h> #include <stdio.h> static int failures; __attribute__((noinline)) static void barrier(void) { __asm__ volatile("" ::: "memory"); } #define CASE(name, old, cst, sh) \ __attribute__((noinline)) static uint64_t name(void) \ { \ uint64_t o; \ __asm__ volatile("lhi %%r4," #cst "\n\t" /* low 32 known, high not */\ "lghi %%r11," #old "\n\t" /* whole register constant */\ "sllk %%r11,%%r4," #sh "\n\t" /* 32-bit write = deposit */\ ::: "r4", "r11"); \ barrier(); /* ends the translation block */ \ __asm__ volatile("lgr %[o],%%r11\n\t" : [o] "=r" (o)); \ return o; \ } \ static void chk_##name(void) \ { \ uint64_t got = name(); \ uint64_t want = (uint64_t)(uint32_t)((uint32_t)(cst) << (sh)); \ if (got != want) { \ failures++; \ printf(" lghi r11,%-6d lhi r4,%-6d sllk r11,r4,%d " \ "expected=%016llx got=%016llx FAIL\n", \ (old), (cst), (sh), \ (unsigned long long)want, (unsigned long long)got); \ } \ } /* old value == result: that is what makes z_mask == o_mask. */ CASE(a, 256, 128, 1) CASE(b, 128, 128, 0) CASE(c, 512, 128, 2) CASE(d, 2, 1, 1) int main(void) { chk_a(); chk_b(); chk_c(); chk_d(); printf("%d failure(s)\n", failures); return failures != 0; } ``` <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->