[Qemu-devel] Bug: ARM target uses an inconsistent offset when storing R15

[Qemu-devel] Bug: ARM target uses an inconsistent offset when storing R15

[Chris McNett]

[-- Attachment #1: Type: text/plain, Size: 1393 bytes --]

Hi,

According to the ARM Architecture Reference Manual:
"An implementation must use the same offset for all STR and STM instructions
that store R15.  It cannot use 8 for some of them and 12 for others."

Qemu appears to be inconsistent in this behavior.  Specifically, the
following two instructions:

 stmdb sp!, {pc}
 str pc, [sp, #-4]

use different offsets.

The following test code will verify this:

#include <stdio.h>

int main(void) {
 unsigned long x, y;
 asm volatile(
 "sub r1, pc, #4\n"
 "stmdb sp!, {pc}\n"
 "ldmia sp!, {r2}\n"
 "sub %0, r2, r1" :
 "=r"(x) :
 :
 "r1", "r2");

 asm volatile(
 "sub r1, pc, #4\n"
 "str pc, [sp, #-4]\n"
 "ldr r2, [sp, #-4]\n"
 "sub %0, r2, r1" :
 "=r"(y) :
 :
 "r1", "r2");
 printf("%ld %ld\n", x, y);
}

On qemu, the code prints "12 8".  On an XScale processor, the code prints "8
8".

In the qemu-0.8.2 sources, one fix for this is to change lines 1727-1728 of
target-arm/translate.c from:
                                /* special case: r15 = PC + 12 */
                                val = (long)s->pc + 8;
to:
                                /* special case: r15 = PC + 8 */
                                val = (long)s->pc + 4;

Once this change is made, the test code will print out "8 8" as XScale
hardware does.

As an alternative, the offset used in other store instructions could be
changed to 12 instead of 8.

Thanks,
Chris McNett

[-- Attachment #2: Type: text/html, Size: 2501 bytes --]