Skip to content

fix(riscv): reject reserved RV32 shift-immediate encodings - #254

Closed
carlosqwqqwq wants to merge 1 commit into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-rv32-shift-imm-reserved
Closed

fix(riscv): reject reserved RV32 shift-immediate encodings#254
carlosqwqqwq wants to merge 1 commit into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-rv32-shift-imm-reserved

Conversation

@carlosqwqqwq

Copy link
Copy Markdown
Contributor

fix(riscv): reject reserved RV32 shift-immediate encodings

Closes #249

Summary

On RV32, the shift-immediate instructions slli/srli/srai encode a 5-bit shamt in bits 24:20; bit 25 is part of funct6 and must be 0. The Zb* overlays (bseti/bclri/binvi/bexti/rori) share the same field and are likewise reserved with bit25 set on RV32. The affected RV32 decoder masked shamt to 5 bits but never rejected a set bit25, so encodings such as srli x5,x6,32 (0x02035293) executed as a shift by zero instead of raising an illegal-instruction trap. QEMU raises SIGILL for these encodings.

The fix rejects any RV32 OP-IMM shift-family encoding with bit25 set in both decode_shift_left_imm and decode_shift_right_imm.

Validation

  • cargo test --lib: the targeted shift-immediate tests pass, and the full library test suite passes with no regressions.

No new upstream test files are added; this is a source-only change.

@19h

19h commented Aug 12, 2026

Copy link
Copy Markdown
Member

Thank you for reporting #249 and proposing a fix. This is now independently consolidated in #255 for the base and Zb* RV32 shift-immediate families, with RV64 controls, SMIR/JIT frontier checks, and an independent qemu-riscv32 SIGILL probe for the reported witness. To keep review and CI focused on one rollup, I am closing this PR in favor of #255. You are credited as co-author on the rollup commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RV32 shift-immediate encodings with the reserved bit25 set are executed

2 participants