blob: abf5ff8a0c0089825c8f7d67b4737a25ef423bd3 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
id = 2419
title = "ldapr_stlr_i instructions doesn't consider signed offset"
state = "closed"
created_at = "2024-07-02T13:05:24.359Z"
closed_at = "2024-07-19T01:20:04.204Z"
labels = ["accel: TCG", "kind::Bug", "target: arm", "workflow::Patch available"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2419"
host-os = "Linux"
host-arch = "ARM"
qemu-version = "8.1.3"
guest-os = "Linux"
guest-arch = "ARM"
description = """The format ldapr_stlr_i models the load acquire / store release immediate instructions. \\
These instructions has a bug in the sign extension calculation of the imm field. \\
imm should be defined as s9 instead of 9.
@ldapr_stlr_i .. ...... .. . imm:9 .. rn:5 rt:5 &ldapr_stlr_i
Should be changed to:
@ldapr_stlr_i .. ...... .. . imm:s9 .. rn:5 rt:5 &ldapr_stlr_i"""
reproduce = """1. Run ARM target
2. Generate any ldapr_stlr_i instructions (for example: LDAPUR)
3. When the imm value is negative, the immediate calculation is done wrong. In case the calculation leads to an undefined location, QEMU will fail."""
additional = """In trans_LDAPR_i (translate-a64.c), when imm field is negative, the value of a->imm will be 512-x instead of x. \\
I already fixed the issue by adding the s9 to the imm field. This made a call to sextend32 for imm instead of extend32 in the generated file build/libqemu-aarch64-softmmu.fa.p/decode-a64.c.inc"""
|