ARM: Detect a bad offset field for the VFP Ldm/Stm instructions in the decoder.

diff --git a/src/arch/arm/isa/formats/fp.isa b/src/arch/arm/isa/formats/fp.isa
index 55668e5f6e2f262b13ff0d9344aacc4b2683afe3..1bb15fd5ba79cc5a1d98811ee7f69c5d7f0e8e3f 100644 (file)
--- a/src/arch/arm/isa/formats/fp.isa
+++ b/src/arch/arm/isa/formats/fp.isa
@@ -96,20 +96,25 @@ let {{
             }
             break;
           case 0x1:
-            switch (bits(opcode, 1, 0)) {
-              case 0x0:
-                return new VLdmStm(machInst, rn, vd, single,
-                                   true, false, false, offset);
-              case 0x1:
-                return new VLdmStm(machInst, rn, vd, single,
-                                   true, false, true, offset);
-              case 0x2:
-                return new VLdmStm(machInst, rn, vd, single,
-                                   true, true, false, offset);
-              case 0x3:
-                // If rn == sp, then this is called vpop.
-                return new VLdmStm(machInst, rn, vd, single,
-                                   true, true, true, offset);
+            {
+                if (offset == 0 || vd + offset > NumFloatArchRegs) {
+                    break;
+                }
+                switch (bits(opcode, 1, 0)) {
+                  case 0x0:
+                    return new VLdmStm(machInst, rn, vd, single,
+                                       true, false, false, offset);
+                  case 0x1:
+                    return new VLdmStm(machInst, rn, vd, single,
+                                       true, false, true, offset);
+                  case 0x2:
+                    return new VLdmStm(machInst, rn, vd, single,
+                                       true, true, false, offset);
+                  case 0x3:
+                    // If rn == sp, then this is called vpop.
+                    return new VLdmStm(machInst, rn, vd, single,
+                                       true, true, true, offset);
+                }
             }
           case 0x2:
             if (bits(opcode, 1, 0) == 0x2) {