From dc0bc8e7855643c4c2aaff74409bada9761b390e Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 23 Jul 2021 10:33:42 -1000 Subject: target/arm: Correctly bound length in sve_zcr_get_valid_len Currently, our only caller is sve_zcr_len_for_el, which has already masked the length extracted from ZCR_ELx, so the masking done here is a nop. But we will shortly have uses from other locations, where the length will be unmasked. Saturate the length to ARM_MAX_VQ instead of truncating to the low 4 bits. Signed-off-by: Richard Henderson Reviewed-by: Peter Maydell Message-id: 20210723203344.968563-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell --- target/arm/helper.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'target') diff --git a/target/arm/helper.c b/target/arm/helper.c index 0c07ca9837..8c1d8dbce3 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6461,7 +6461,9 @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) { uint32_t end_len; - end_len = start_len &= 0xf; + start_len = MIN(start_len, ARM_MAX_VQ - 1); + end_len = start_len; + if (!test_bit(start_len, cpu->sve_vq_map)) { end_len = find_last_bit(cpu->sve_vq_map, start_len); assert(end_len < start_len); -- cgit v1.2.3