ldapr_stlr_i instructions doesn't consider signed offset
Host environment
- Operating system: Linux
- Architecture: ARM
- QEMU flavor: qemu-system-aarch64
- QEMU version: 8.1.3
Emulated/Virtualized environment
- Operating system: Linux
- Architecture: ARM
Description of problem
The format ldapr_stlr_i models the load acquire / store release immediate instructions.
These instructions has a bug in the sign extension calculation of the imm field.
imm should be defined as s9 instead of 9.
@ldapr_stlr_i .. ...... .. . imm:9 .. rn:5 rt:5 &ldapr_stlr_i
Should be changed to:
@ldapr_stlr_i .. ...... .. . imm:s9 .. rn:5 rt:5 &ldapr_stlr_i
Steps to reproduce
- Run ARM target
- Generate any ldapr_stlr_i instructions (for example: LDAPUR)
- When the imm value is negative, the immediate calculation is done wrong. In case the calculation leads to an undefined location, QEMU will fail.
Additional information
In trans_LDAPR_i (translate-a64.c), when imm field is negative, the value of a->imm will be 512-x instead of x.
I already fixed the issue by adding the s9 to the imm field. This made a call to sextend32 for imm instead of extend32 in the generated file build/libqemu-aarch64-softmmu.fa.p/decode-a64.c.inc
Edited by Eliran Roffe