1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
id = 2386
title = "RISCV - Incorrect behaviour of the SLL instruction"
state = "closed"
created_at = "2024-06-09T18:31:27.404Z"
closed_at = "2024-06-09T18:38:34.624Z"
labels = ["Closed::Invalid"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2386"
host-os = "WSL2, Windows 10"
host-arch = "x86"
qemu-version = "qemu-riscv64 version 9.0.50 (v9.0.0-1377-g3e246da2c3)"
guest-os = "n/a"
guest-arch = "n/a"
description = """`SLL` (and probably other similar instructions) produce incorrect results. To quote the [RISCV ISA manual](https://drive.google.com/file/d/1uviu1nH-tScFfgrovvFCrj7Omv8tFtkp/view):
> SLL, SRL, and SRA perform logical left, logical right, and arithmetic right shifts on the value in register
rs1 by the shift amount held in the lower 5 bits of register rs2.
This instruction should perform a logical shift left by the shift amount from the lower 5 bits held in the third operand, however, it doesn't seem to be the case. As can be seen from the result of the snippet below: `55c3585000000000`, it seems that it calculates the correct value, but then shifts it by another 32 bits to the left:
```python
correct_shift_res = (0xDB4D6868655C3585 << (0x69C99AB9B9401024 & 0b11111)) & (2 ** 64 - 1)
incorrect_qemu_produced = (correct_shift_res << 32) & (2 ** 64 - 1)
```"""
reproduce = """1. Compile the attached source file: `riscv64-linux-gnu-gcc -static repro.c -o ./repro.elf`
```c
#include <stdint.h>
#include <stdio.h>
int main() {
uint64_t a = 0x69C99AB9B9401024;
uint64_t b = 0xDB4D6868655C3585;
uint64_t c;
asm volatile("sll %0, %1, %2" : "=r"(c) : "r"(b), "r"(a));
printf("s8 : %lx\\n", c);
printf("expected: %lx\\n", 0xb4d6868655c35850);
return 0;
}
```
2. Run qemu: `./qemu-riscv64 ./repro.elf`
3. You will see the output and what the result of the computation should really be:
```
s8 : 55c3585000000000
expected: b4d6868655c35850
```"""
additional = """"""
|