On 9/10/26 19:22, Chao Liu wrote:
On Tue, Sep 08, 2026 at 12:47:55PM +0800, wangyang wrote:
The XTheadBb th.srri instruction uses the low log2(XLEN) bits of
imm6. The generic shift helper rejects values greater than or equal to
XLEN, which incorrectly rejects imm6 values 32 through 63 on RV32.
Normalize the operand before calling the helper.
Tested: RV32 imm6 0, 31, 32, and 63 witnesses with XTheadBb
enabled and disabled.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4413
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Signed-off-by: wangyang <[email protected]>
---
target/riscv/tcg/insn_trans/trans_xthead.c.inc | 1 +
1 file changed, 1 insertion(+)
diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc
b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
index 681f70e5bc..34226b1be5 100644
--- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
@@ -141,6 +141,7 @@ GEN_TRANS_TH_ADDSL(3)
static bool trans_th_srri(DisasContext *ctx, arg_th_srri * a)
{
REQUIRE_XTHEADBB(ctx);
+ a->shamt &= get_olen(ctx) - 1;
Looks right, but usually we handle this in decodetree. We don't
normally modify the decoded arguments directly, so could you move
the normalization into decodetree instead—e.g. a dedicated RV32
pattern/trans like zext_h_32/pack?
just like:
{
th_srri_rv32 000100 -..... ..... 001 ..... 0001011 @sh5
th_srri 000100 ...... ..... 001 ..... 0001011 @sh6
}
Given that the cpu seems to decoode rather than reject the bit, I'd
handle this in translation rather than decode.
r~
