On Tue, Sep 08, 2026 at 12:47:55PM +0800, wangyang wrote:
> The XTheadBb th.srri instruction uses the low log2(XLEN) bits of
> imm6. The generic shift helper rejects values greater than or equal to
> XLEN, which incorrectly rejects imm6 values 32 through 63 on RV32.
> Normalize the operand before calling the helper.
>
> Tested: RV32 imm6 0, 31, 32, and 63 witnesses with XTheadBb
> enabled and disabled.
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4413
> Reviewed-by: Daniel Henrique Barboza <[email protected]>
>
> Signed-off-by: wangyang <[email protected]>
> ---
> target/riscv/tcg/insn_trans/trans_xthead.c.inc | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> index 681f70e5bc..34226b1be5 100644
> --- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> +++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> @@ -141,6 +141,7 @@ GEN_TRANS_TH_ADDSL(3)
> static bool trans_th_srri(DisasContext *ctx, arg_th_srri * a)
> {
> REQUIRE_XTHEADBB(ctx);
> + a->shamt &= get_olen(ctx) - 1;
Looks right, but usually we handle this in decodetree. We don't
normally modify the decoded arguments directly, so could you move
the normalization into decodetree instead—e.g. a dedicated RV32
pattern/trans like zext_h_32/pack?
just like:
{
th_srri_rv32 000100 -..... ..... 001 ..... 0001011 @sh5
th_srri 000100 ...... ..... 001 ..... 0001011 @sh6
}
Thanks,
Chao
> return gen_shift_imm_fn_per_ol(ctx, a, EXT_NONE,
> tcg_gen_rotri_tl, gen_roriw, NULL);
> }
> --
> 2.55.0.windows.2
>
