[LoongArch64] Miscompilation at -O2/O3

[XChy]

Testcase:

target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "loongarch64-unknown-linux-musl"

@BS_CHECKSUM = global i64 0
@.str = constant [32 x i8] c"BackSmith Checksum = 0x%016llx\0A\00"

define i64 @func_14() {
entry:
  callbr void asm sideeffect "", "!i"()
          to label %asm.fallthrough [label %BS_LABEL_0]

asm.fallthrough:                                  ; preds = %entry
  br label %BS_LABEL_0

BS_LABEL_0:                                       ; preds = %BS_LABEL_0, %asm.fallthrough, %entry
  %l_1780.1 = phi i16 [ 0, %BS_LABEL_0 ], [ 0, %entry ], [ 1, %asm.fallthrough ]
  %p_16.addr.0 = phi i32 [ 0, %BS_LABEL_0 ], [ 1, %entry ], [ 0, %asm.fallthrough ]
  callbr void asm sideeffect "", "!i"()
          to label %asm.fallthrough66 [label %BS_LABEL_0]

asm.fallthrough66:                                ; preds = %BS_LABEL_0
  %0 = insertelement <4 x i32> zeroinitializer, i32 %p_16.addr.0, i64 0
  %vecinit5 = insertelement <4 x i32> %0, i32 %p_16.addr.0, i64 1
  %conv6 = zext <4 x i32> %vecinit5 to <4 x i64>
  %vecext = extractelement <4 x i64> %conv6, i64 0
  %tobool25.not = icmp eq i64 %vecext, 0
  %cond = select i1 %tobool25.not, i64 1, i64 -1
  %1 = insertelement <4 x i64> zeroinitializer, i64 %cond, i64 0
  %vecext29 = extractelement <4 x i64> %conv6, i64 1
  %tobool30.not = icmp eq i64 %vecext29, 0
  %cond35 = select i1 %tobool30.not, i64 1, i64 -1
  %vecinit61 = insertelement <4 x i64> %1, i64 %cond35, i64 1
  %vecext62 = extractelement <4 x i64> %vecinit61, i16 %l_1780.1
  store i64 %vecext62, ptr @BS_CHECKSUM, align 8
  ret i64 0
}

define i32 @main() {
entry:
  %call2 = call i64 @func_14()
  %0 = load i64, ptr @BS_CHECKSUM, align 8
  %call1 = call i32 (ptr, ...) @printf(ptr @.str, i64 %0)
  ret i32 0
}

Commands:

> clang --target=loongarch64-unknown-linux-musl --gcc-toolchain=/opt/loongarch64 --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -DARCH_LOONGARCH64 -static -O2 reduced.ll
> qemu-loongarch64 a.out
BackSmith Checksum = 0xffffffffffffffff

> clang --target=loongarch64-unknown-linux-musl --gcc-toolchain=/opt/loongarch64 --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -DARCH_LOONGARCH64 -static -O0 reduced.ll
> qemu-loongarch64 a.out
BackSmith Checksum = 0x0000000000000001

This testcase is run with llubi, and shows no UB. Let me know if you want unreduced C testcase.

[llvmbot]

@llvm/issue-subscribers-backend-loongarch

Author: Hongyu Chen (XChy)

Testcase: ```llvm

target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "loongarch64-unknown-linux-musl"

@BS_CHECKSUM = global i64 0
@.str = constant [32 x i8] c"BackSmith Checksum = 0x%016llx\0A\00"

define i64 @func_14() {
entry:
callbr void asm sideeffect "", "!i"()
to label %asm.fallthrough [label %BS_LABEL_0]

asm.fallthrough: ; preds = %entry
br label %BS_LABEL_0

BS_LABEL_0: ; preds = %BS_LABEL_0, %asm.fallthrough, %entry
%l_1780.1 = phi i16 [ 0, %BS_LABEL_0 ], [ 0, %entry ], [ 1, %asm.fallthrough ]
%p_16.addr.0 = phi i32 [ 0, %BS_LABEL_0 ], [ 1, %entry ], [ 0, %asm.fallthrough ]
callbr void asm sideeffect "", "!i"()
to label %asm.fallthrough66 [label %BS_LABEL_0]

asm.fallthrough66: ; preds = %BS_LABEL_0
%0 = insertelement <4 x i32> zeroinitializer, i32 %p_16.addr.0, i64 0
%vecinit5 = insertelement <4 x i32> %0, i32 %p_16.addr.0, i64 1
%conv6 = zext <4 x i32> %vecinit5 to <4 x i64>
%vecext = extractelement <4 x i64> %conv6, i64 0
%tobool25.not = icmp eq i64 %vecext, 0
%cond = select i1 %tobool25.not, i64 1, i64 -1
%1 = insertelement <4 x i64> zeroinitializer, i64 %cond, i64 0
%vecext29 = extractelement <4 x i64> %conv6, i64 1
%tobool30.not = icmp eq i64 %vecext29, 0
%cond35 = select i1 %tobool30.not, i64 1, i64 -1
%vecinit61 = insertelement <4 x i64> %1, i64 %cond35, i64 1
%vecext62 = extractelement <4 x i64> %vecinit61, i16 %l_1780.1
store i64 %vecext62, ptr @BS_CHECKSUM, align 8
ret i64 0
}

define i32 @main() {
entry:
%call2 = call i64 @func_14()
%0 = load i64, ptr @BS_CHECKSUM, align 8
%call1 = call i32 (ptr, ...) @printf(ptr @.str, i64 %0)
ret i32 0
}

Commands:
```bash
> clang --target=loongarch64-unknown-linux-musl --gcc-toolchain=/opt/loongarch64 --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -DARCH_LOONGARCH64 -static -O2 reduced.ll
> qemu-loongarch64 a.out
BackSmith Checksum = 0xffffffffffffffff

> clang --target=loongarch64-unknown-linux-musl --gcc-toolchain=/opt/loongarch64 --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -DARCH_LOONGARCH64 -static -O0 reduced.ll
> qemu-loongarch64 a.out
BackSmith Checksum = 0x0000000000000001

This testcase is run with llubi, and shows no UB. Let me know if you want unreduced C testcase.

[heiher]

Thank you for the report. Could you provide more details, such as the LLVM version and asm code? I wasn't able to reproduce the issue on the main branch at this commit: c379127

[XChy]

At clang commit 6aab826.
Assembly:

 .file   "reduced.ll"
        .text
        .globl  func_14                         # -- Begin function func_14
        .p2align        5
        .type   func_14,@function
func_14:                                # @func_14
# %bb.0:                                # %entry
        move    $a0, $zero
        ori     $a1, $zero, 1
        #APP
        #NO_APP
# %bb.1:                                # %asm.fallthrough
        move    $a1, $zero
        ori     $a0, $zero, 1
.LBB0_2:                                # Inline asm indirect target
                                        # %BS_LABEL_0.preheader
                                        # Label of block must be emitted
        addi.d  $sp, $sp, -32
        #APP
        #NO_APP
.LBB0_3:                                # %asm.fallthrough66
        vrepli.b        $vr0, 0
        vst     $vr0, $sp, 16
        vinsgr2vr.w     $vr0, $a1, 0
        vinsgr2vr.w     $vr0, $a1, 1
        vseqi.w $vr0, $vr0, 0
        vshuf4i.w       $vr0, $vr0, 16
        vslli.d $vr0, $vr0, 32
        vsrai.d $vr0, $vr0, 32
        vrepli.d        $vr1, 1
        vrepli.b        $vr2, -1
        vbitsel.v       $vr0, $vr2, $vr1, $vr0
        vst     $vr0, $sp, 0
        slli.d  $a0, $a0, 3
        addi.d  $a1, $sp, 0
        or      $a0, $a1, $a0
        ld.d    $a0, $a0, 0
        pcalau12i       $a1, %got_pc_hi20(BS_CHECKSUM)
        ld.d    $a1, $a1, %got_pc_lo12(BS_CHECKSUM)
        st.d    $a0, $a1, 0
        move    $a0, $zero
        addi.d  $sp, $sp, 32
        ret
.LBB0_4:                                # Inline asm indirect target
                                        # %BS_LABEL_0.preheader5
                                        # Label of block must be emitted
.LBB0_5:                                # Inline asm indirect target
                                        # %BS_LABEL_0
                                        # =>This Inner Loop Header: Depth=1
                                        # Label of block must be emitted
        #APP
        #NO_APP
        move    $a0, $zero
        move    $a1, $zero
        b       .LBB0_3
.Lfunc_end0:
        .size   func_14, .Lfunc_end0-func_14
                                        # -- End function
        .globl  main                            # -- Begin function main
        .p2align        5
        .type   main,@function
main:                                   # @main
# %bb.0:                                # %entry
        move    $a0, $zero
        ori     $a1, $zero, 1
        #APP
        #NO_APP
# %bb.1:                                # %asm.fallthrough.i
        move    $a1, $zero
        ori     $a0, $zero, 1
.LBB1_2:                                # Inline asm indirect target
                                        # %BS_LABEL_0.preheader.i
                                        # Label of block must be emitted
        addi.d  $sp, $sp, -48
        st.d    $ra, $sp, 40                    # 8-byte Folded Spill
        #APP
        #NO_APP
.LBB1_3:                                # %func_14.exit
        vrepli.b        $vr0, 0
        vst     $vr0, $sp, 16
        vinsgr2vr.w     $vr0, $a1, 0
        vinsgr2vr.w     $vr0, $a1, 1
        vseqi.w $vr0, $vr0, 0
        vshuf4i.w       $vr0, $vr0, 16
        vslli.d $vr0, $vr0, 32
        vsrai.d $vr0, $vr0, 32
        vrepli.d        $vr1, 1
        vrepli.b        $vr2, -1
        vbitsel.v       $vr0, $vr2, $vr1, $vr0
        vst     $vr0, $sp, 0
        slli.d  $a0, $a0, 3
        addi.d  $a1, $sp, 0
        or      $a0, $a1, $a0
        ld.d    $a1, $a0, 0
        pcalau12i       $a0, %got_pc_hi20(BS_CHECKSUM)
        ld.d    $a0, $a0, %got_pc_lo12(BS_CHECKSUM)
        st.d    $a1, $a0, 0
        pcalau12i       $a0, %got_pc_hi20(.str)
        ld.d    $a0, $a0, %got_pc_lo12(.str)
        pcaddu18i       $ra, %call36(printf)
        jirl    $ra, $ra, 0
        move    $a0, $zero
        ld.d    $ra, $sp, 40                    # 8-byte Folded Reload
        addi.d  $sp, $sp, 48
        ret
.LBB1_4:                                # Inline asm indirect target
                                        # %BS_LABEL_0.i.preheader
                                        # Label of block must be emitted
.LBB1_5:                                # Inline asm indirect target
                                        # %BS_LABEL_0.i
                                        # =>This Inner Loop Header: Depth=1
                                        # Label of block must be emitted
        #APP
        #NO_APP
        move    $a0, $zero
        move    $a1, $zero
        b       .LBB1_3
.Lfunc_end1:
        .size   main, .Lfunc_end1-main
                                        # -- End function
        .type   BS_CHECKSUM,@object             # @BS_CHECKSUM
        .bss
        .globl  BS_CHECKSUM
        .p2align        3, 0x0
BS_CHECKSUM:
        .dword  0                               # 0x0
        .size   BS_CHECKSUM, 8

        .type   .str,@object                    # @.str
        .section        .rodata,"a",@progbits
        .globl  .str
        .p2align        4, 0x0
.str:
        .asciz  "BackSmith Checksum = 0x%016llx\n"
        .size   .str, 32

        .section        ".note.GNU-stack","",@progbits
        .addrsig
        .addrsig_sym .str

clang --target=loongarch64-unknown-linux-musl --gcc-toolchain=/opt/loongarch64 --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -O2 -static reduced.ll -v:

Target: loongarch64-unknown-linux-musl
Thread model: posix
InstalledDir: /usr/local/bin
Build config: +assertions
Found candidate GCC installation: /opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0
Selected GCC installation: /opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0
Candidate multilib: .;@m64
Selected multilib: .;@m64
 "/usr/local/bin/clang-22" -cc1 -triple loongarch64-unknown-linux-musl -O2 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name reduced.ll -static-define -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -ffp-contract=on -fno-rounding-math -mconstructor-aliases -target-cpu loongarch64 -target-feature +lsx -target-feature +relax -target-feature +64bit -target-feature +f -target-feature +d -target-feature +ual -target-abi lp64d -debugger-tuning=gdb -fdebug-compilation-dir=/home/shareduser/XChy/Projects/BackSmithCases/37 -v -fcoverage-compilation-dir=/home/shareduser/XChy/Projects/BackSmithCases/37 -resource-dir /usr/local/lib/clang/22 -ferror-limit 19 -fmessage-length=113 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -o /tmp/reduced-1fe3aa.o -x ir reduced.ll
clang -cc1 version 22.0.0git based upon LLVM 22.0.0git default target x86_64-unknown-linux-gnu
 "/opt/loongarch64/bin/loongarch64-unknown-linux-musl-ld" --sysroot=/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot -z relro --hash-style=gnu --eh-frame-hdr -m elf64loongarch -X -static -o a.out /opt/loongarch64/loongarch64-unknown-linux-musl/sysroot/usr/lib/crt1.o /opt/loongarch64/loongarch64-unknown-linux-musl/sysroot/usr/lib/crti.o /opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0/crtbeginT.o -L/opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0 -L/opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0/../../../../loongarch64-unknown-linux-musl/lib -L/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot/lib -L/opt/loongarch64/loongarch64-unknown-linux-musl/sysroot/usr/lib /tmp/reduced-1fe3aa.o --start-group -lgcc -lgcc_eh -lc --end-group /opt/loongarch64/lib/gcc/loongarch64-unknown-linux-musl/16.0.0/crtend.o /opt/loongarch64/loongarch64-unknown-linux-musl/sysroot/usr/lib/crtn.o

There may be some target features you need. Feel free to ask for other information if needed.

[heiher]

This seems to be a bug in QEMU, since everything works fine on real hardware. It looks like TCG mis-translates vldi when it's placed in the same TB as some other instructions. Running qemu-loongarch64 with -one-insn-per-tb avoids the issue. I haven't fully tracked down exactly what's going wrong yet...

[XChy]

@heiher, thanks for your feedback. How about posting an issue to QEMU? Let me know if you confirm the LoongArch backend emits the correct asm. Thanks!

[heiher]

I believe the code generated by LLVM’s LoongArch backend is correct. I reduced the assembly to a minimal case, and it seems the issue lies with vbitsel.v: when a constant condition is used as input, the optimizer eliminates the runtime conditional select but ends up choosing the wrong operand.

        .text
        .p2align    5
        .globl  _start
        .type   _start,@function
_start:
        vldi    $vr1, 3073
        vldi    $vr2, 1023

        vbitsel.v       $vr0, $vr2, $vr1, $vr2
        vpickve2gr.d    $a1, $vr0, 1

        li.w    $a0, 1
1:      bne     $a0, $a1, 1b
        break   0

[XChy]

@heiher, thanks a lot for your work. Would you mind if I post an issue to QEMU with your reduced testcase?

[heiher]

@heiher, thanks a lot for your work. Would you mind if I post an issue to QEMU with your reduced testcase?

Thanks again. I’ve already sent the fix patch to QEMU.

https://lists.gnu.org/archive/html/qemu-devel/2025-09/msg03923.html