[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Bug 1922887] [NEW] STR in Thumb 32 decode problem
From: |
JIANG Muhui |
Subject: |
[Bug 1922887] [NEW] STR in Thumb 32 decode problem |
Date: |
Wed, 07 Apr 2021 07:53:31 -0000 |
Public bug reported:
Hi
It seems that QEMU does not have a proper check on the STR instruction
in Thumb32 mode.
Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111
0000 1101 1101 1101.
This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.
The symbols is
Rn = 1111
Rt = 0000
P = 1
U = 0
W = 1
The decode ASL is below:
if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then
SEE PUSH;
if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
if t == 15 || (wback && n == t) then UNPREDICTABLE;
When Rn == 1111, it should be an undefined instruction, which should
raise SEGILL signal. However, it seems that QEMU does not check this
constraint, which should be a bug. Many thanks
Regards
Muhui
** Affects: qemu
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887
Title:
STR in Thumb 32 decode problem
Status in QEMU:
New
Bug description:
Hi
It seems that QEMU does not have a proper check on the STR instruction
in Thumb32 mode.
Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111
0000 1101 1101 1101.
This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.
The symbols is
Rn = 1111
Rt = 0000
P = 1
U = 0
W = 1
The decode ASL is below:
if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’
then SEE PUSH;
if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
if t == 15 || (wback && n == t) then UNPREDICTABLE;
When Rn == 1111, it should be an undefined instruction, which should
raise SEGILL signal. However, it seems that QEMU does not check this
constraint, which should be a bug. Many thanks
Regards
Muhui
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions
- [Bug 1922887] [NEW] STR in Thumb 32 decode problem,
JIANG Muhui <=