Commit e79b445d authored by Richard Henderson's avatar Richard Henderson Committed by Peter Maydell
Browse files

target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs 



Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same.  This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab where the bug was
introduced was marked for stable.

Fixes: adf92eab
Cc: qemu-stable@nongnu.org (3.0.1)
Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 506e4a00

target/arm/helper.c

+24 −21
Original line number Diff line number Diff line
@@ -12587,18 +12587,19 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 
    uint32_t flags;



    if (is_a64(env)) {

        int sve_el = sve_exception_el(env);

        uint32_t zcr_len;



        *pc = env->pc;

        flags = ARM_TBFLAG_AARCH64_STATE_MASK;

        /* Get control bits for tagged addresses */

        flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);

        flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);

        flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;



        if (arm_feature(env, ARM_FEATURE_SVE)) {

            int sve_el = sve_exception_el(env);

            uint32_t zcr_len;



            /* If SVE is disabled, but FP is enabled,

           then the effective len is 0.  */

             * then the effective len is 0.

             */

            if (sve_el != 0 && fp_el == 0) {

                zcr_len = 0;

            } else {
@@ -12616,7 +12617,9 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 
                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);

                }

            }

            flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;

            flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;

        }

    } else {

        *pc = env->regs[15];

        flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)