From eaefb97a8b97dbf42c016fe65b68b92f99a346f6 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 1 Feb 2019 14:55:45 +0000 Subject: [PATCH] target/arm/translate-a64: Fix mishandling of size in FCMLA decode In disas_simd_indexed(), for the case of "complex fp", each indexable element is a complex pair, so the total size is twice that indicated in the 'size' field in the encoding. We were trying to do this "double the size" operation with a left shift by 1, but this is incorrect because the 'size' field is a MO_8/MO_16/MO_32/MO_64 value, and doubling the size should be done by a simple increment. This meant we were mishandling FCMLA (by element) of values where the real and imaginary parts are 32-bit floats, and would incorrectly UNDEF this encoding. (No other insns take this code path, and for 16-bit floats it happens that 1 << 1 and 1 + 1 are both the same). Reported-by: Laurent Desnogues Signed-off-by: Peter Maydell Reviewed-by: Laurent Desnogues Message-id: 20190129140411.682-3-peter.maydell@linaro.org --- target/arm/translate-a64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index d46ea9f64e..b864ac7a69 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -12680,7 +12680,7 @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn) case 2: /* complex fp */ /* Each indexable element is a complex pair. */ - size <<= 1; + size += 1; switch (size) { case MO_32: if (h && !is_q) { -- 2.30.2