RISC-V: execution starts from an odd PC (IALIGN=16 violation)
Rechecked revision
The report was rechecked against the public Unicorn dev branch at
938efd13aeab73155f31cf707a2094c6ccaa36dd.
API boundary
Legal RISC-V control transfers obey IALIGN. This report targets the Unicorn
public entry boundary: a caller can pass an odd begin address to
uc_emu_start or write an odd UC_RISCV_REG_PC, after which the fetch path
currently decodes from that address. The reproduction therefore tests an
externally supplied invalid emulator state, not an odd target produced by a
legal guest branch. If maintainers prefer rejecting the state in an API setter
rather than at fetch time, the same public witness can be used for that design.
Public reproducer
The minimal Python witness is available at
https://github.com/carlosqwqqwq/unicorn-riscv-repros/tree/main/u025.
It starts the public U54 model at 0x10001 and records the executed PCs and
the returned Unicorn error.
Expected behavior
The first fetch from an odd address must raise the instruction-address-
misaligned exception before any guest instruction executes. An aligned entry
point and legal compressed/32-bit streams must remain unchanged.
Root cause and proposed fix
riscv_tr_translate_insn fetches at ctx->base.pc_next without checking bit
0. The proposed change checks the address before fetch and raises the existing
instruction-address-misaligned exception. The focused regression is included
in PR #2394.
RISC-V: execution starts from an odd PC (IALIGN=16 violation)
Rechecked revision
The report was rechecked against the public Unicorn
devbranch at938efd13aeab73155f31cf707a2094c6ccaa36dd.API boundary
Legal RISC-V control transfers obey IALIGN. This report targets the Unicorn
public entry boundary: a caller can pass an odd
beginaddress touc_emu_startor write an oddUC_RISCV_REG_PC, after which the fetch pathcurrently decodes from that address. The reproduction therefore tests an
externally supplied invalid emulator state, not an odd target produced by a
legal guest branch. If maintainers prefer rejecting the state in an API setter
rather than at fetch time, the same public witness can be used for that design.
Public reproducer
The minimal Python witness is available at
https://github.com/carlosqwqqwq/unicorn-riscv-repros/tree/main/u025.
It starts the public U54 model at
0x10001and records the executed PCs andthe returned Unicorn error.
Expected behavior
The first fetch from an odd address must raise the instruction-address-
misaligned exception before any guest instruction executes. An aligned entry
point and legal compressed/32-bit streams must remain unchanged.
Root cause and proposed fix
riscv_tr_translate_insnfetches atctx->base.pc_nextwithout checking bit0. The proposed change checks the address before fetch and raises the existing
instruction-address-misaligned exception. The focused regression is included
in PR #2394.