[Qemu-arm] [PATCH v1 1/1] target/arm: Fix vector operation segfault

[Alistair Francis]

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, 
s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, 
insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at 
./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, 
cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 
<arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized 
out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (address@hidden, address@hidden 
<code_gen_buffer+126091347>, address@hidden) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (address@hidden, pc=3067096216, cs_base=0, 
flags=192, cflags=-16252928, address@hidden) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, 
last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at 
./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (address@hidden) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at 
./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (address@hidden) at 
./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at 
./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn(). We hit the second switch case as
NEON_3R_VQADD and NEON_3R_VQSUB don't return from the function in the
first switch case.

Signed-off-by: Alistair Francis <address@hidden>
---
 target/arm/translate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 10bc53f91c..cbb32757e9 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -6749,6 +6749,9 @@ static int disas_neon_data_insn(DisasContext *s, uint32_t 
insn)
             tmp2 = neon_load_reg(rm, pass);
         }
         switch (op) {
+        case NEON_3R_VQADD:
+        case NEON_3R_VQSUB:
+            break;
         case NEON_3R_VHADD:
             GEN_NEON_INTEGER_OP(hadd);
             break;
-- 
2.21.0