On Sat, Feb 7, 2026 at 11:06 AM Brian Cain <[email protected]> wrote:
> A duplex encoding like 0x00000000 decodes as two loads that both write r0. > > Add a check in decode_insns() after both sub-instructions decode > successfully to verify they don't write the same destination register. > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2696 > Signed-off-by: Brian Cain <[email protected]> > Reviewed-by: Pierrick Bouvier <[email protected]> > --- > target/hexagon/decode.c | 12 ++++++++++++ > tests/tcg/hexagon/invalid-encoding.c | 29 ++++++++++++++++++++++++++++ > 2 files changed, 41 insertions(+) > > diff --git a/target/hexagon/decode.c b/target/hexagon/decode.c > index 69ba1ec96c..90499fc320 100644 > --- a/target/hexagon/decode.c > +++ b/target/hexagon/decode.c > @@ -501,12 +501,24 @@ decode_insns(DisasContext *ctx, Insn *insn, uint32_t > encoding) > > /* The slot1 subinsn needs to be in the packet first */ > if (decode_slot1_subinsn(ctx, slot1_subinsn)) { > + Insn *slot1_insn = insn; > insn->generate = opcode_genptr[insn->opcode]; > insn->iclass = iclass_bits(encoding); > ctx->insn = ++insn; > if (decode_slot0_subinsn(ctx, slot0_subinsn)) { > insn->generate = opcode_genptr[insn->opcode]; > insn->iclass = iclass_bits(encoding); > + /* > + * Check that the two sub-instructions don't write the > same > + * destination register (e.g., encoding 0x0 decodes as two > + * loads both writing R0, which is an invalid packet). > + */ > + if (insn->dest_idx >= 0 && slot1_insn->dest_idx >= 0 && > + insn->regno[insn->dest_idx] == > + slot1_insn->regno[slot1_insn->dest_idx]) { > + ctx->insn = --insn; > + return 0; > + } > > Isn't this a more general problem than what is checked here? What if two non-duplex instructions write the same register? What if an instruction writes more than one register (e.g., post-increment load)? Let the decoding go ahead and finish, then add a check for duplicate writes for the whole packet. Look at ctx_log_reg_write - called during analyze_packet. Thanks, Taylor
