qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Bug 1922887] [NEW] STR in Thumb 32 decode problem
@ 2021-04-07  7:53 JIANG Muhui
  2021-04-07  8:53 ` [Bug 1922887] " Peter Maydell
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: JIANG Muhui @ 2021-04-07  7:53 UTC (permalink / raw)
  To: qemu-devel

Public bug reported:

Hi

It seems that QEMU does not have a proper check on the STR instruction
in Thumb32 mode.

Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

The symbols is

Rn = 1111
Rt = 0000
P = 1
U = 0
W = 1

The decode ASL is below:

if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
if t == 15 || (wback && n == t) then UNPREDICTABLE;

When Rn == 1111, it should be an undefined instruction, which should
raise SEGILL signal. However, it seems that QEMU does not check this
constraint, which should be a bug. Many thanks

Regards
Muhui

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  New

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
@ 2021-04-07  8:53 ` Peter Maydell
  2021-04-07  9:16 ` Peter Maydell
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2021-04-07  8:53 UTC (permalink / raw)
  To: qemu-devel

** Tags added: arm

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  New

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
  2021-04-07  8:53 ` [Bug 1922887] " Peter Maydell
@ 2021-04-07  9:16 ` Peter Maydell
  2021-04-08 16:51 ` Peter Maydell
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2021-04-07  9:16 UTC (permalink / raw)
  To: qemu-devel

NB that for Arm mode the equivalent case is UNPREDICTABLE only in the
writeback case (and has defined behaviour for non-writeback), so we need
to enforce the UNDEF on rn==15 for Thumb decode only.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  New

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
  2021-04-07  8:53 ` [Bug 1922887] " Peter Maydell
  2021-04-07  9:16 ` Peter Maydell
@ 2021-04-08 16:51 ` Peter Maydell
  2021-04-09 13:43 ` JIANG Muhui
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2021-04-08 16:51 UTC (permalink / raw)
  To: qemu-devel

Patch sent to list: if you could test it against whatever your test case was that would be helpful.
https://patchew.org/QEMU/20210408162402.5822-1-peter.maydell@linaro.org/

PS: out of interest, why/how were you checking should-UNDEF cases ?


** Changed in: qemu
       Status: New => In Progress

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  In Progress

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
                   ` (2 preceding siblings ...)
  2021-04-08 16:51 ` Peter Maydell
@ 2021-04-09 13:43 ` JIANG Muhui
  2021-05-15 14:30 ` Thomas Huth
  2021-08-25  7:12 ` Thomas Huth
  5 siblings, 0 replies; 7+ messages in thread
From: JIANG Muhui @ 2021-04-09 13:43 UTC (permalink / raw)
  To: qemu-devel

We just test the patched version. It looks well. Now QEMU would raise
SEGILL signals, which should be the right behavior.

We are not checking should-UNDEF cases in particular. This is a case we
observed and checked manually when doing a research project with QEMU.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  In Progress

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
                   ` (3 preceding siblings ...)
  2021-04-09 13:43 ` JIANG Muhui
@ 2021-05-15 14:30 ` Thomas Huth
  2021-08-25  7:12 ` Thomas Huth
  5 siblings, 0 replies; 7+ messages in thread
From: Thomas Huth @ 2021-05-15 14:30 UTC (permalink / raw)
  To: qemu-devel

Patch has been merged:
https://gitlab.com/qemu-project/qemu/-/commit/8196fe9d83d6519128b5

** Changed in: qemu
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  Fix Committed

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 1922887] Re: STR in Thumb 32 decode problem
  2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
                   ` (4 preceding siblings ...)
  2021-05-15 14:30 ` Thomas Huth
@ 2021-08-25  7:12 ` Thomas Huth
  5 siblings, 0 replies; 7+ messages in thread
From: Thomas Huth @ 2021-08-25  7:12 UTC (permalink / raw)
  To: qemu-devel

** Changed in: qemu
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1922887

Title:
  STR in Thumb 32 decode problem

Status in QEMU:
  Fix Released

Bug description:
  Hi

  It seems that QEMU does not have a proper check on the STR instruction
  in Thumb32 mode.

  Specifically, the machine code is 0xf84f0ddd, which is 0b1111 1000 0100 1111 0000 1101 1101 1101. 
  This is an STR (immediate, Thumb) instruction with a T4 encoding scheme.

  The symbols is

  Rn = 1111
  Rt = 0000
  P = 1
  U = 0
  W = 1

  The decode ASL is below:

  if P == ‘1’ && U == ‘1’ && W == ‘0’ then SEE STRT;
  if Rn == ‘1101’ && P == ‘1’ && U == ‘0’ && W == ‘1’ && imm8 == ‘00000100’ then SEE PUSH;
  if Rn == ‘1111’ || (P == ‘0’ && W == ‘0’) then UNDEFINED;
  t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32);
  index = (P == ‘1’); add = (U == ‘1’); wback = (W == ‘1’);
  if t == 15 || (wback && n == t) then UNPREDICTABLE;

  When Rn == 1111, it should be an undefined instruction, which should
  raise SEGILL signal. However, it seems that QEMU does not check this
  constraint, which should be a bug. Many thanks

  Regards
  Muhui

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1922887/+subscriptions



^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-08-25  7:24 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-07  7:53 [Bug 1922887] [NEW] STR in Thumb 32 decode problem JIANG Muhui
2021-04-07  8:53 ` [Bug 1922887] " Peter Maydell
2021-04-07  9:16 ` Peter Maydell
2021-04-08 16:51 ` Peter Maydell
2021-04-09 13:43 ` JIANG Muhui
2021-05-15 14:30 ` Thomas Huth
2021-08-25  7:12 ` Thomas Huth

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).