[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 2/4] target-arm: A64: Fix handling of rotate in logi
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PATCH 2/4] target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask |
Date: |
Fri, 6 Feb 2015 14:34:08 +0000 |
The code in logic_imm_decode_wmask attempts to rotate a mask
value within the bottom 'e' bits of the value with
mask = (mask >> r) | (mask << (e - r));
This has two issues:
* if the element size is 64 then a rotate by zero results
in a shift left by 64, which is undefined behaviour
* if the element size is smaller than 64 then this will
leave junk in the value at bit 'e' and above, which is
not valid input to bitfield_replicate(). As it happens,
the bits at bit 'e' to '2e - r' are exactly the ones
which bitfield_replicate is going to copy in there,
so this isn't a "wrong code generated" bug, but it's
confusing and if we ever put an assert in
bitfield_replicate it would fire on valid guest code.
Fix the former by not doing anything if r is zero, and
the latter by masking with bitmask64(e).
Signed-off-by: Peter Maydell <address@hidden>
---
target-arm/translate-a64.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/target-arm/translate-a64.c b/target-arm/translate-a64.c
index d3801c5..94b3bf4 100644
--- a/target-arm/translate-a64.c
+++ b/target-arm/translate-a64.c
@@ -2820,7 +2820,10 @@ static bool logic_imm_decode_wmask(uint64_t *result,
unsigned int immn,
* by r within the element (which is e bits wide)...
*/
mask = bitmask64(s + 1);
- mask = (mask >> r) | (mask << (e - r));
+ if (r) {
+ mask = (mask >> r) | (mask << (e - r));
+ mask &= bitmask64(e);
+ }
/* ...then replicate the element over the whole 64 bit value */
mask = bitfield_replicate(mask, e);
*result = mask;
--
1.9.1
- [Qemu-devel] [PATCH 0/4] target-arm: fix various clang UB sanitizer warnings, Peter Maydell, 2015/02/06
- [Qemu-devel] [PATCH 4/4] target-arm: A64: Avoid signed shifts in disas_ldst_pair(), Peter Maydell, 2015/02/06
- [Qemu-devel] [PATCH 2/4] target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask,
Peter Maydell <=
- [Qemu-devel] [PATCH 1/4] target-arm: A64: Fix shifts into sign bit, Peter Maydell, 2015/02/06
- [Qemu-devel] [PATCH 3/4] target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr, Peter Maydell, 2015/02/06
- Re: [Qemu-devel] [PATCH 0/4] target-arm: fix various clang UB sanitizer warnings, Greg Bellows, 2015/02/06
- Re: [Qemu-devel] [PATCH 0/4] target-arm: fix various clang UB sanitizer warnings, Richard Henderson, 2015/02/06
- Re: [Qemu-devel] [PATCH 0/4] target-arm: fix various clang UB sanitizer warnings, Eric Blake, 2015/02/06