[Qemu-devel] Bug: ARM target uses an inconsistent offset when storing R15

[Chris McNett]

Hi,

According to the ARM Architecture Reference Manual:
"An implementation must use the same offset for all STR and STM instructions that store R15.  It cannot use 8 for some of them and 12 for others."

Qemu appears to be inconsistent in this behavior.  Specifically, the following two instructions:

 stmdb sp!, {pc}
 str pc, [sp, #-4]

use different offsets.

The following test code will verify this:

#include <stdio.h>

int main(void) {
 unsigned long x, y;
 asm volatile(
 "sub r1, pc, #4\n"
 "stmdb sp!, {pc}\n"
 "ldmia sp!, {r2}\n"
 "sub %0, r2, r1" :
 "=r"(x) :
 :
 "r1", "r2");

 asm volatile(
 "sub r1, pc, #4\n"
 "str pc, [sp, #-4]\n"
 "ldr r2, [sp, #-4]\n"
 "sub %0, r2, r1" :
 "=r"(y) :
 :
 "r1", "r2");
 printf("%ld %ld\n", x, y);
}

On qemu, the code prints "12 8".  On an XScale processor, the code prints "8 8".

In the qemu-0.8.2 sources, one fix for this is to change lines 1727-1728 of target-arm/translate.c from:
                                /* special case: r15 = PC + 12 */
                                val = (long)s->pc + 8;
to:
                                /* special case: r15 = PC + 8 */
                                val = (long)s->pc + 4;

Once this change is made, the test code will print out "8 8" as XScale hardware does.

As an alternative, the offset used in other store instructions could be changed to 12 instead of 8.

Thanks,
Chris McNett