id = 2386
title = "RISCV - Incorrect behaviour of the SLL instruction"
state = "closed"
created_at = "2024-06-09T18:31:27.404Z"
closed_at = "2024-06-09T18:38:34.624Z"
labels = ["Closed::Invalid"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2386"
host-os = "WSL2, Windows 10"
host-arch = "x86"
qemu-version = "qemu-riscv64 version 9.0.50 (v9.0.0-1377-g3e246da2c3)"
guest-os = "n/a"
guest-arch = "n/a"
description = """`SLL` (and probably other similar instructions) produce incorrect results. To quote the [RISCV ISA manual](https://drive.google.com/file/d/1uviu1nH-tScFfgrovvFCrj7Omv8tFtkp/view):

> SLL, SRL, and SRA perform logical left, logical right, and arithmetic right shifts on the value in register
rs1 by the shift amount held in the lower 5 bits of register rs2.

This instruction should perform a logical shift left by the shift amount from the lower 5 bits held in the third operand, however, it doesn't seem to be the case. As can be seen from the result of the snippet below: `55c3585000000000`, it seems that it calculates the correct value, but then shifts it by another 32 bits to the left:

```python
correct_shift_res = (0xDB4D6868655C3585 << (0x69C99AB9B9401024 & 0b11111)) & (2 ** 64 - 1)
incorrect_qemu_produced = (correct_shift_res << 32) & (2 ** 64 - 1)
```"""
reproduce = """1. Compile the attached source file: `riscv64-linux-gnu-gcc -static repro.c -o ./repro.elf`

```c
#include <stdint.h>
#include <stdio.h>

int main() {
  uint64_t a = 0x69C99AB9B9401024;
  uint64_t b = 0xDB4D6868655C3585;
  uint64_t c;

  asm volatile("sll %0, %1, %2" : "=r"(c) : "r"(b), "r"(a));

  printf("s8      : %lx\\n", c);
  printf("expected: %lx\\n", 0xb4d6868655c35850);

  return 0;
}
```

2. Run qemu: `./qemu-riscv64 ./repro.elf`
3. You will see the output and what the result of the computation should really be:

```
s8      : 55c3585000000000
expected: b4d6868655c35850
```"""
additional = """"""