Skip to content

fix(encoder): high-register Thumb CMN uses 32-bit CMN.W (#184) - #187

Merged
avrabe merged 3 commits into
mainfrom
fix/cmn-high-reg-guard-184
May 30, 2026
Merged

avrabe merged 3 commits into
mainfrom
fix/cmn-high-reg-guard-184

Conversation

@avrabe

@avrabe avrabe commented May 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Closes #184 — the last sibling of the #180 16-bit-truncation class found by the encoder audit.

The 16-bit CMN (T1) reg-form (0x42C0 | rm<<3 | rn) only encodes R0–R7; high-register operands (R8–R11/R12) overflow the 3-bit fields and corrupt the operands. CMN has no high-register 16-bit form, so high registers now fall back to 32-bit CMN.W (EB10 Rn | 0F00 Rm — ADD.W with S=1, Rd discarded as PC).

Verification

  • Byte-level encoder regression test (cmn r10, r8 → EB1A 0F08; low-reg cmn r1,r2 stays 16-bit 0x42D1)
  • Ground-truth checked against gas: arm-none-eabi-as assembles cmn r10, r8 to exactly eb1a 0f08
  • Full suite: 1284 passed, 0 failed

Reachability

Latent — the optimized divide-by-zero/INT_MIN guard uses the CMN immediate form (already 32-bit CMN.W), and the reg-form is only emitted by the non-optimized selector with low registers. Closed as defense-in-depth: the last 16-bit reg-form encoder lacking a high-register guard (Add/Adds/Subs fixed in #180; MVNS sites use hardcoded R0).

Closes #184.

🤖 Generated with Claude Code

avrabe and others added 2 commits May 30, 2026 11:26
Sibling of #180: the 16-bit CMN (T1) reg-form (0x42C0) only encodes R0-R7;
high registers overflow the 3-bit fields and corrupt the operands. CMN has no
high-register 16-bit form, so guard rn/rm < 8 and fall back to 32-bit CMN.W
(EB10 Rn | 0F00 Rm). Byte-verified against gas (`cmn r10, r8` = EB1A 0F08).

Latent until now (the optimized div-guard uses the CMN *immediate* form; the
reg-form is only emitted by the non-optimized selector with low registers), but
closed as defense-in-depth — the last of the #180 16-bit-truncation class.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bump version + every path-dep pin 0.11.4 → 0.11.5 (Cargo.toml ×11 + MODULE.bazel
+ Cargo.lock). CHANGELOG [0.11.5] with falsification statement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@temper-pulseengine

Copy link
Copy Markdown
Contributor

Automated review for PR #187

pulseengine/synth:fix/cmn-high-reg-guard-184 → pulseengine/synth:main

Verdict: 💬 Comment

Summary: The patch addresses a critical bug in the Thumb CMN instruction encoding, ensuring that high-register operands are handled correctly. This resolves a latent issue and improves the overall reliability of the Synth compiler.

Findings: 0 mechanical (rivet) · 1 from local AI model.

Findings (1):

  1. CHANGELOG.md:23
    +## [0.11.5] - 2026-05-30
    

+Patch: high-register Thumb CMN (#184). Closes the last sibling of the #180
+16-bit-truncation class. The 16-bit CMN (T1) reg-form encodes only R0–R7;
+high-register operands overflowed the 3-bit fields. CMN has no high-register
+16-bit form, so high registers now use 32-bit CMN.W (EB10 Rn | 0F00 Rm),
+byte-verified against gas. Latent (the optimized divide-guard uses the CMN
+immediate form; the reg-form is only emitted by the non-optimized selector
+with low registers) — closed as defense-in-depth.

The patch correctly handles high-register Thumb CMN instructions.

---
*Generated by a local AI model and post-validated against a strict JSON contract. Each finding includes the verbatim line being criticised — verify by reading the file at the cited location.*

*Reviewed at `af97137`*

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@codecov

codecov Bot commented May 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@avrabe
avrabe merged commit 2f8b571 into main May 30, 2026
11 of 13 checks passed
@avrabe
avrabe deleted the fix/cmn-high-reg-guard-184 branch May 30, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

arm encoder audit: CMN register-form lacks high-register guard (sibling of #180)

1 participant