Skip to content

riscv: reject reserved shamt[5] bit of C.SLLI/C.SRLI/C.SRAI on RV32 - #287

Merged
LekKit merged 1 commit into
LekKit:stagingfrom
carlosqwqqwq:fix/rv32-cshift-shamt5
Aug 12, 2026
Merged

riscv: reject reserved shamt[5] bit of C.SLLI/C.SRLI/C.SRAI on RV32#287
LekKit merged 1 commit into
LekKit:stagingfrom
carlosqwqqwq:fix/rv32-cshift-shamt5

Conversation

@carlosqwqqwq

Copy link
Copy Markdown

Fix: reject reserved shamt[5] bit of C.SLLI/C.SRLI/C.SRAI on RV32

Problem

decode_c_shamt() ignores bit 12 for RV32, and the three compressed-shift
decoders (c.slli, c.srli, c.srai) never check it, so 1536 reserved RV32
encodings (bit 12 == 1, i.e. shamt[5]) are executed as valid shifts instead
of raising an illegal-instruction exception.

Change

Add an RV32-only check at the top of each shift decoder that raises an
illegal-instruction trap when bit 12 is set:

#if !defined(RISCV64)
            if (unlikely(insn & 0x1000)) { // shamt[5] is reserved in RV32
                riscv_illegal_insn(vm, insn);
                return;
            }
#endif

RV64 behavior is unchanged (bit 12 is the valid shamt[5]).

Verification

  • 8 sampled reserved encodings (0x1002/0x1082/0x1086, 0x9001/0x9005/0x9009,
    0x9101/0x9105) now trap on both the JIT and interpreter paths, matching QEMU.
  • Regression: legal c.slli/c.srli/c.srai (including the rd == x0 hints)
    and c.andi still execute correctly.

Fixes #285.

@LekKit
LekKit merged commit 047f3df into LekKit:staging Aug 12, 2026
26 of 27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RV32: reserved shamt[5] bit in C.SLLI/C.SRLI/C.SRAI is silently executed

2 participants