yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-01-22 20:51:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask

Browse source 
The code in logic_imm_decode_wmask attempts to rotate a mask
value within the bottom 'e' bits of the value with
mask = (mask >> r) | (mask << (e - r));
This has two issues:
* if the element size is 64 then a rotate by zero results
in a shift left by 64, which is undefined behaviour
* if the element size is smaller than 64 then this will
leave junk in the value at bit 'e' and above, which is
not valid input to bitfield_replicate(). As it happens,
the bits at bit 'e' to '2e - r' are exactly the ones
which bitfield_replicate is going to copy in there,
so this isn't a "wrong code generated" bug, but it's
confusing and if we ever put an assert in
bitfield_replicate it would fire on valid guest code.

Fix the former by not doing anything if r is zero, and
the latter by masking with bitmask64(e).

Backports commit e167adc9d9f5df4f8109aecd4552c407fdce094a from qemu
This commit is contained in:
Peter Maydell 2018-02-12 15:02:10 -05:00 committed by Lioncash
parent b95cba4677
commit 0e9a6a26f5
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
qemu/target-arm/translate-a64.c
View file

@ -2857,7 +2857,10 @@ static bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
* by r within the element (which is e bits wide)...
*/
mask = bitmask64(s + 1);
mask = (mask >> r) | (mask << (e - r));
if (r) {
mask = (mask >> r) | (mask << (e - r));
mask &= bitmask64(e);
}
/* ...then replicate the element over the whole 64 bit value */
mask = bitfield_replicate(mask, e);
*result = mask;