## Host environment - Operating system: macOS on Apple M5 Max (`sysctl hw.optional.arm.FEAT_CSSC: 1`) - OS/kernel version: macOS (Darwin 27.0.0) - Architecture: aarch64 (host with FEAT_CSSC) - QEMU flavor: qemu-system-aarch64 (TCG) - QEMU version: master, commit 81ce3a87737aa50716c42db8886082d12783e0a1 (2026-09-27, reports 11.1.50). Also checked: the constants are unchanged on current master. - QEMU command line: ``` qemu-system-aarch64 -M virt -cpu max -nographic -semihosting -kernel smax.elf ``` ## Emulated/Virtualized environment - Operating system: none (bare-metal test program, attached) - Architecture: aarch64 guest, `-cpu max` ## Description of problem `tcg/aarch64/tcg-target.c.inc` defines the FEAT_CSSC register forms with the opcode field one hex digit too low: ``` Irrr_SMAX = 0x1ac00600, Irrr_UMAX = 0x1ac00640, Irrr_SMIN = 0x1ac00680, Irrr_UMIN = 0x1ac006c0, ``` When the host has FEAT_CSSC (`cpuinfo & CPUINFO_CSSC`), TCG emits these values for smin/smax/umin/umax operations. They are unallocated encodings, so QEMU dies with SIGILL (exit status 132) as soon as generated code executes one. Correct encodings (Arm ARM, SMAX/SMIN/UMAX/UMIN (register), 32-bit form), confirmed with `llvm-mc -triple=aarch64 -mattr=+cssc -show-encoding` on `op w0, w0, w0`: | Instruction | Correct | Current master | |-------------|---------|----------------| | SMAX | 0x1ac06000 | 0x1ac00600 | | UMAX | 0x1ac06400 | 0x1ac00640 | | SMIN | 0x1ac06800 | 0x1ac00680 | | UMIN | 0x1ac06c00 | 0x1ac006c0 | The released 11.1.1 does not crash with the same test, so this looks like a regression after 11.1 (I did not bisect). ## Steps to reproduce 1. Build the attached `smax.S` (loads two values from memory so TCG cannot constant-fold, executes one guest `smax w0, w1, w2`, then exits through semihosting): ``` clang --target=aarch64-none-elf -march=armv8.9-a+cssc -nostdlib -ffreestanding -c smax.S -o smax.o ld.lld -Ttext=0x40080000 -e _start smax.o -o smax.elf ``` 2. Run: `qemu-system-aarch64 -M virt -cpu max -nographic -semihosting -kernel smax.elf; echo rc=$?` 3. Observe `rc=132` (SIGILL). The attached `ctrl.S` (same program with `add` instead of `smax`) exits with `rc=0`. Results on the Apple M5 Max host: | QEMU | ctrl.elf | smax.elf | |------|----------|----------| | master 81ce3a87 | rc 0 | rc 132 (SIGILL) | | master 81ce3a87 + fix below | rc 0 | rc 0 | | 11.1.1 release | rc 0 | rc 0 | Note: with constant operands (`mov w1,#5; mov w2,#7`) the optimizer folds the operation and the crash does not show. ## Additional information Proposed fix (attached as `0001-tcg-aarch64-fix-CSSC-min-max-encodings.diff`, tested as shown above): ```diff --- a/tcg/aarch64/tcg-target.c.inc +++ b/tcg/aarch64/tcg-target.c.inc @@ -549,10 +549,10 @@ typedef enum { Irrr_UMULH = 0x9bc07c00, Irrr_UDIV = 0x1ac00800, Irrr_SDIV = 0x1ac00c00, - Irrr_SMAX = 0x1ac00600, - Irrr_UMAX = 0x1ac00640, - Irrr_SMIN = 0x1ac00680, - Irrr_UMIN = 0x1ac006c0, + Irrr_SMAX = 0x1ac06000, + Irrr_UMAX = 0x1ac06400, + Irrr_SMIN = 0x1ac06800, + Irrr_UMIN = 0x1ac06c00, ``` Any host with FEAT_CSSC should be affected (Linux hosts detect it through HWCAP2_CSSC in `util/cpuinfo-aarch64.c`); I could only test on macOS. /cc @rth7680 (AArch64 TCG target maintainer per MAINTAINERS) Attachments to add: `smax.S`, `ctrl.S`, `0001-tcg-aarch64-fix-CSSC-min-max-encodings.diff` (all in this folder). [smax.S](/uploads/3d16ed010a96ee42633deb5afe09adbe/smax.S) [ctrl.S](/uploads/ad548d551f03b6f0741f4fae54ea3d15/ctrl.S) [0001-tcg-aarch64-fix-CSSC-min-max-encodings.diff](/uploads/6a0d8c3a95e79a8a44fd83870dd6edf6/0001-tcg-aarch64-fix-CSSC-min-max-encodings.diff)