diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2019-02-01 14:55:45 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-02-01 14:55:45 +0000 |
| commit | eaefb97a8b97dbf42c016fe65b68b92f99a346f6 (patch) | |
| tree | 47de13116ddfb1a84ef887a833aaf609221478a8 /target/arm/translate-a64.c | |
| parent | 4dfabb6d568e6b315594d7d464dacaf3368aff60 (diff) | |
| download | qemu-eaefb97a8b97dbf42c016fe65b68b92f99a346f6.zip | |
target/arm/translate-a64: Fix mishandling of size in FCMLA decode
In disas_simd_indexed(), for the case of "complex fp", each indexable
element is a complex pair, so the total size is twice that indicated
in the 'size' field in the encoding. We were trying to do this
"double the size" operation with a left shift by 1, but this is
incorrect because the 'size' field is a MO_8/MO_16/MO_32/MO_64
value, and doubling the size should be done by a simple increment.
This meant we were mishandling FCMLA (by element) of values where
the real and imaginary parts are 32-bit floats, and would incorrectly
UNDEF this encoding. (No other insns take this code path, and for
16-bit floats it happens that 1 << 1 and 1 + 1 are both the same).
Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20190129140411.682-3-peter.maydell@linaro.org
Diffstat (limited to 'target/arm/translate-a64.c')
| -rw-r--r-- | target/arm/translate-a64.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index d46ea9f64e..b864ac7a69 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -12680,7 +12680,7 @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn) case 2: /* complex fp */ /* Each indexable element is a complex pair. */ - size <<= 1; + size += 1; switch (size) { case MO_32: if (h && !is_q) { |