Skip to content

AArch64: SYSL writes its Rt operand, it does not read it - #3045

Merged
Rot127 merged 1 commit into
capstone-engine:nextfrom
gaul:aarch64-sysl-rt-access
Sep 1, 2026
Merged

Rot127 merged 1 commit into
capstone-engine:nextfrom
gaul:aarch64-sysl-rt-access

Conversation

@gaul

@gaul gaul commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Your checklist for this pull request

  • I've documented or updated the documentation of every API function and struct this PR changes.
  • I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

SYSL was generated with CS_AC_READ on Rt, but Rt is the destination. "SYSL , #, , {, #}" is the system instruction WITH RESULT, and the Arm ARM names Xt "the 64-bit name of the general-purpose destination register", encoded in the Rt field.

Before:

  sysl x0, #0, c0, c0, #0
    operands[0].type: REG = x0
    operands[0].access: READ
  Registers read: x0

After:

  sysl x0, #0, c0, c0, #0
    operands[0].type: REG = x0
    operands[0].access: WRITE
  Registers modified: x0

A consumer tracking register liveness saw a use where there is a definition, which is the unsafe direction: a value written into Xt looked like it was still needed.

SYS (without the L) is the opposite direction -- its Xt is a source, and it takes it as the last operand -- and is already CS_AC_READ; it is untouched.

Test plan

Adds the correction to suite/auto-sync/inc_patches so it survives regeneration, plus a regression case. That case asserts regs_write rather than the operand list because two of SYSL's five operands are AARCH64_OP_CIMM, which cstest's operand comparison does not handle (it would take the default branch and report "op type not handled").

Closing issues

@gaul
gaul force-pushed the aarch64-sysl-rt-access branch from f6ea0d6 to 60baf74 Compare August 31, 2026 16:18
SYSL was generated with CS_AC_READ on Rt, but Rt is the destination.
"SYSL <Xt>, #<op1>, <Cn>, <Cm>{, #<op2>}" is the system instruction
WITH RESULT, and the Arm ARM names Xt "the 64-bit name of the
general-purpose destination register", encoded in the Rt field.

Before:

  sysl x0, #0, c0, c0, #0
    operands[0].type: REG = x0
    operands[0].access: READ
  Registers read: x0

After:

  sysl x0, #0, c0, c0, #0
    operands[0].type: REG = x0
    operands[0].access: WRITE
  Registers modified: x0

A consumer tracking register liveness saw a use where there is a
definition, which is the unsafe direction: a value written into Xt
looked like it was still needed.

SYS (without the L) is the opposite direction -- its Xt is a source,
and it takes it as the last operand -- and is already CS_AC_READ; it is
untouched.
@gaul
gaul force-pushed the aarch64-sysl-rt-access branch from 60baf74 to 00c1666 Compare August 31, 2026 16:21
@Rot127
Rot127 merged commit aa91e73 into capstone-engine:next Sep 1, 2026
59 of 60 checks passed
@gaul
gaul deleted the aarch64-sysl-rt-access branch September 1, 2026 15:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants