Re: [Qemu-devel] [PATCH for-3.1] target/arm: Remove can't-happen if() from handle_vec_simd_shli()

2018-10-31 Thread Alex Bennée 


Peter Maydell  writes:

> In handle_vec_simd_shli() we have a check:
>  if (size > 3 && !is_q) {
>  unallocated_encoding(s);
>  return;
>  }
> However this can never be true, because we calculate
> int size = 32 - clz32(immh) - 1;
> where immh is a 4 bit field which we know cannot be all-zeroes.
> So the clz32() return must be in {28,29,30,31} and the resulting
> size is in {0,1,2,3}, and "size > 3" is never true.
>
> This unnecessary code confuses Coverity's analysis:
> in CID 1396476 it thinks we might later index off the
> end of an array because the condition implies that we
> might have a size > 3.
>
> Remove the code, and instead assert that the size is in [0..3],
> since the decode that enforces that is somewhat distant from
> this function.
>
> Signed-off-by: Peter Maydell 
> ---
> Alex, if you could run this through the risu testset just as
> a sanity check that would be very helpful.
>
>  target/arm/translate-a64.c | 8 +++-
>  1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
> index 88195ab9490..fd36425f1ae 100644
> --- a/target/arm/translate-a64.c
> +++ b/target/arm/translate-a64.c
> @@ -9483,12 +9483,10 @@ static void handle_vec_simd_shli(DisasContext *s, 
> bool is_q, bool insert,
>  int immhb = immh << 3 | immb;
>  int shift = immhb - (8 << size);
>
> -if (extract32(immh, 3, 1) && !is_q) {
> -unallocated_encoding(s);
> -return;
> -}
> +/* Range of size is limited by decode: immh is a non-zero 4 bit field */
> +assert(size >= 0 && size <= 3);
>
> -if (size > 3 && !is_q) {
> +if (extract32(immh, 3, 1) && !is_q) {
>  unallocated_encoding(s);
>  return;
>  }

Reviewed-by: Alex Bennée 
Tested-by: Alex Bennée 


--
Alex Bennée

Re: [Qemu-devel] [PATCH for-3.1] target/arm: Remove can't-happen if() from handle_vec_simd_shli()

2018-10-30 Thread Philippe Mathieu-Daudé 

On 30/10/18 17:25, Peter Maydell wrote:

In handle_vec_simd_shli() we have a check:
  if (size > 3 && !is_q) {
  unallocated_encoding(s);
  return;
  }
However this can never be true, because we calculate
 int size = 32 - clz32(immh) - 1;
where immh is a 4 bit field which we know cannot be all-zeroes.
So the clz32() return must be in {28,29,30,31} and the resulting
size is in {0,1,2,3}, and "size > 3" is never true.

This unnecessary code confuses Coverity's analysis:
in CID 1396476 it thinks we might later index off the
end of an array because the condition implies that we
might have a size > 3.

Remove the code, and instead assert that the size is in [0..3],
since the decode that enforces that is somewhat distant from
this function.

Signed-off-by: Peter Maydell 


Reviewed-by: Philippe Mathieu-Daudé 


---
Alex, if you could run this through the risu testset just as
a sanity check that would be very helpful.

  target/arm/translate-a64.c | 8 +++-
  1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 88195ab9490..fd36425f1ae 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -9483,12 +9483,10 @@ static void handle_vec_simd_shli(DisasContext *s, bool 
is_q, bool insert,
  int immhb = immh << 3 | immb;
  int shift = immhb - (8 << size);
  
-if (extract32(immh, 3, 1) && !is_q) {

-unallocated_encoding(s);
-return;
-}
+/* Range of size is limited by decode: immh is a non-zero 4 bit field */
+assert(size >= 0 && size <= 3);
  
-if (size > 3 && !is_q) {

+if (extract32(immh, 3, 1) && !is_q) {
  unallocated_encoding(s);
  return;
  }

[Qemu-devel] [PATCH for-3.1] target/arm: Remove can't-happen if() from handle_vec_simd_shli()

2018-10-30 Thread Peter Maydell 
In handle_vec_simd_shli() we have a check:
 if (size > 3 && !is_q) {
 unallocated_encoding(s);
 return;
 }
However this can never be true, because we calculate
int size = 32 - clz32(immh) - 1;
where immh is a 4 bit field which we know cannot be all-zeroes.
So the clz32() return must be in {28,29,30,31} and the resulting
size is in {0,1,2,3}, and "size > 3" is never true.

This unnecessary code confuses Coverity's analysis:
in CID 1396476 it thinks we might later index off the
end of an array because the condition implies that we
might have a size > 3.

Remove the code, and instead assert that the size is in [0..3],
since the decode that enforces that is somewhat distant from
this function.

Signed-off-by: Peter Maydell 
---
Alex, if you could run this through the risu testset just as
a sanity check that would be very helpful.

 target/arm/translate-a64.c | 8 +++-
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 88195ab9490..fd36425f1ae 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -9483,12 +9483,10 @@ static void handle_vec_simd_shli(DisasContext *s, bool 
is_q, bool insert,
 int immhb = immh << 3 | immb;
 int shift = immhb - (8 << size);
 
-if (extract32(immh, 3, 1) && !is_q) {
-unallocated_encoding(s);
-return;
-}
+/* Range of size is limited by decode: immh is a non-zero 4 bit field */
+assert(size >= 0 && size <= 3);
 
-if (size > 3 && !is_q) {
+if (extract32(immh, 3, 1) && !is_q) {
 unallocated_encoding(s);
 return;
 }
-- 
2.19.1