Re: [PATCH v3 2/5] target/riscv: mask RV32 XTheadBb th.srri shift amount

[Chao Liu <chao.liu@processmission.com>]

On Tue, Sep 08, 2026 at 12:47:55PM +0800, wangyang wrote:
> The XTheadBb th.srri instruction uses the low log2(XLEN) bits of
> imm6. The generic shift helper rejects values greater than or equal to
> XLEN, which incorrectly rejects imm6 values 32 through 63 on RV32.
> Normalize the operand before calling the helper.
> 
> Tested: RV32 imm6 0, 31, 32, and 63 witnesses with XTheadBb
> enabled and disabled.
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4413
> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
> 
> Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn>
> ---
>  target/riscv/tcg/insn_trans/trans_xthead.c.inc | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> index 681f70e5bc..34226b1be5 100644
> --- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> +++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
> @@ -141,6 +141,7 @@ GEN_TRANS_TH_ADDSL(3)
>  static bool trans_th_srri(DisasContext *ctx, arg_th_srri * a)
>  {
>      REQUIRE_XTHEADBB(ctx);
> +    a->shamt &= get_olen(ctx) - 1;
Looks right, but usually we handle this in decodetree. We don't
normally modify the decoded arguments directly, so could you move
the normalization into decodetree instead—e.g. a dedicated RV32
pattern/trans like zext_h_32/pack?

just like:

{
  th_srri_rv32  000100 -..... ..... 001 ..... 0001011 @sh5
  th_srri       000100 ...... ..... 001 ..... 0001011 @sh6
}

Thanks,
Chao
>      return gen_shift_imm_fn_per_ol(ctx, a, EXT_NONE,
>                                     tcg_gen_rotri_tl, gen_roriw, NULL);
>  }
> -- 
> 2.55.0.windows.2
>