target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
Not only are the sve-related tb_flags fields unused when SVE is disabled, but not all of the cpu registers are initialized properly for computing same. This can corrupt other fields by ORing in -1, which might result in QEMU crashing. This bug was not present in 3.0, but this patch is cc'd to stable becauseadf92eab90
where the bug was introduced was marked for stable. Fixes:adf92eab90
Cc: qemu-stable@nongnu.org (3.0.1) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
parent
506e4a00de
commit
e79b445d89
|
@ -12587,18 +12587,19 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
|
|||
uint32_t flags;
|
||||
|
||||
if (is_a64(env)) {
|
||||
int sve_el = sve_exception_el(env);
|
||||
uint32_t zcr_len;
|
||||
|
||||
*pc = env->pc;
|
||||
flags = ARM_TBFLAG_AARCH64_STATE_MASK;
|
||||
/* Get control bits for tagged addresses */
|
||||
flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
|
||||
flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
|
||||
flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
|
||||
|
||||
if (arm_feature(env, ARM_FEATURE_SVE)) {
|
||||
int sve_el = sve_exception_el(env);
|
||||
uint32_t zcr_len;
|
||||
|
||||
/* If SVE is disabled, but FP is enabled,
|
||||
then the effective len is 0. */
|
||||
* then the effective len is 0.
|
||||
*/
|
||||
if (sve_el != 0 && fp_el == 0) {
|
||||
zcr_len = 0;
|
||||
} else {
|
||||
|
@ -12616,7 +12617,9 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
|
|||
zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
|
||||
}
|
||||
}
|
||||
flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
|
||||
flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
|
||||
}
|
||||
} else {
|
||||
*pc = env->regs[15];
|
||||
flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
|
||||
|
|
Loading…
Reference in a new issue