AArch32: (Thumb32) BranchWritePC does not clear bit-0

[Sleigh-InSPECtor]

As part of a research project testing the accuracy of the SLEIGH specifications compared to real hardware, we observed an unexpected behaviour in the add & mov instruction to pc for Thumb (ARM:LE:32:v8T).

According to the manual, BranchWritePC in Thumb clears bit-0 to 0. However, we noticed the output was incorrect.

---

e.g, for Thumb with,

Instruction: 0xc746, mov pc,r8
initial_registers: { "r8": 0x5165fa67 }

We get:

Hardware: { "pc": 0x5165fa66 }
Patched Spec: { "pc": 0x5165fa66 }
Existing Spec: { "pc": 0x5165fa67 }

and,

Instruction: 0xc744, add pc,r8
initial_registers: { "r8": 0x42728a67, "pc": 0x10000000 }

We get:

Hardware: { "pc": 0x52728a6a }
Patched Spec: { "pc": 0x52728a6a }
Existing Spec: { "pc": 0x52728a6b }

---

Note: The patched spec does not introduce any disassembly changes to the best of our knowledge.

[GhidorahRex]

This is the code for BranchWritePC from the manual, copied here for clarity:

// BranchWritePC()
// ===============
BranchWritePC(bits(32) address_in, BranchType branch_type)
  bits(32) address = address_in;
  if CurrentInstrSet() == InstrSet_A32 then
    address<1:0> = '00';
  else
    address<0> = '0';
  boolean branch_conditional = !(AArch32.CurrentCond() IN {'111x'});
  BranchTo(address, branch_type, branch_conditional);

Clearly, the issue with Thumb needs to be fixed. But it also looks like we need a fix for A32 as well. BranchWritePC probably needs to be split into two functions - one for A32 and one for T32, since that also uses BranchWritePC.