Wrong register access mode reported in thumb pop instruction

[jiegec]

Work environment

Questions	Answers
System Capstone runs on OS/arch/bits	Debian amd64 bookworm
Capstone module affected	arm
Source of Capstone	git clone
Version/git commit	f2f0a3c

Expected behavior

pop instruction of Thumb should have correct register access info:

$ ./cstool -d arm+thumb "f0bd"
 0  f0 bd  pop  {r4, r5, r6, r7, pc}
        ID: 634 (pop)
        op_count: 5
                operands[0].type: REG = r4
                operands[0].access: WRITE
                operands[1].type: REG = r5
                operands[1].access: WRITE
                operands[2].type: REG = r6
                operands[2].access: WRITE
                operands[3].type: REG = r7
                operands[3].access: WRITE
                operands[4].type: REG = r15
                operands[4].access: WRITE
        Registers read: r13
        Registers modified: r13 r4 r5 r6 r7 r15
        Groups: IsThumb return

Actual behavior

Actual output is wrong:

$ ./cstool -d arm+thumb "f0bd"
 0  f0 bd  pop  {r4, r5, r6, r7, pc}
        ID: 634 (pop)
        op_count: 5
                operands[0].type: REG = r4
                operands[0].access: READ
                operands[1].type: REG = r5
                operands[1].access: READ
                operands[2].type: REG = r6
                operands[2].access: READ
                operands[3].type: REG = r7
                operands[3].access: READ
                operands[4].type: REG = r15
                operands[4].access: READ
        Registers read: r13 r4 r5 r6 r7 r15
        Registers modified: r13
        Groups: IsThumb return

Steps to reproduce the behavior

• Run ./cstool -d arm+thumb "f0bd"

Additional Logs, screenshots, source code, configuration dump, ...

Drag and drop zip archives containing the Additional info here, don't use external services or link.
Screenshots can be directly dropped here.

[Rot127]

Happens for all pop instructions with a register list as operand:
#2710 (comment)

[jiegec]

The problem comes from LLVM-generated table:

{ /* ARM_tPOP (4435) - ARM_INS_POP - pop${p}	$regs */
{
  { CS_OP_IMM, CS_AC_READ, { CS_DATA_TYPE_i32, CS_DATA_TYPE_LAST } }, /* p - i32imm */
  { CS_OP_IMM, CS_AC_READ, { CS_DATA_TYPE_i32, CS_DATA_TYPE_LAST } }, /* p - i32imm */
  { CS_OP_IMM, CS_AC_READ, { CS_DATA_TYPE_i32, CS_DATA_TYPE_LAST } }, /* regs */
  { CS_OP_INVALID, CS_AC_READ, { CS_DATA_TYPE_LAST } }, /*  */
  { 0 }
}},

I plan to add another patch under suite/auto-sync/inc_patches/ARM to fix it.