yuzu-emu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-10-20 14:48:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs

Browse Source 
Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same. This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab90e3f5f34c285 where the bug was
introduced was marked for stable.

Backports commit e79b445d896deb61909be52b61b87c98a9ed96f7 from qemu
This commit is contained in:
Richard Henderson 2018-09-25 21:17:23 -04:00 committed by Lioncash
parent 8446222237
commit 994038c817
No known key found for this signature in database
GPG Key ID: 4E3C3CC1031BA9C7
1 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
qemu/target/arm/helper.c
View File

@ -11817,25 +11817,29 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
uint32_t flags;
if (is_a64(env)) {
int sve_el = sve_exception_el(env);
uint32_t zcr_len;
*pc = env->pc;
flags = ARM_TBFLAG_AARCH64_STATE_MASK;
/* Get control bits for tagged addresses */
flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
if (arm_feature(env, ARM_FEATURE_SVE)) {
int sve_el = sve_exception_el(env);
uint32_t zcr_len;
/* If SVE is disabled, but FP is enabled,
then the effective len is 0. */
* then the effective len is 0.
*/
if (sve_el != 0 && fp_el == 0) {
zcr_len = 0;
} else {
int current_el = arm_current_el(env);
ARMCPU *cpu = arm_env_get_cpu(env);
zcr_len = env->vfp.zcr_el[current_el <= 1 ? 1 : current_el];
zcr_len &= 0xf;
zcr_len = cpu->sve_max_vq - 1;
if (current_el <= 1) {
zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
}
if (current_el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
}
@ -11843,7 +11847,9 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
}
}
flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
}
} else {
*pc = env->regs[15];
flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)