linux-user/arm/nwfpe: Check coprocessor number for FPA emulation

qemu with hax to log dma reads & writes jcs.org/2018/11/12/vfio

Our copy of the nwfpe code for emulating of the old FPA11 floating
point unit doesn't check the coprocessor number in the instruction
when it emulates it. This means that we might treat some
instructions which should really UNDEF as being FPA11 instructions by
accident.

The kernel's copy of the nwfpe code doesn't make this error; I suspect
the bug was noticed and fixed as part of the process of mainlining
the nwfpe code more than a decade ago.

Add a check that the coprocessor number (which is always in bits
[11:8] of the instruction) is either 1 or 2, which is where the
FPA11 lives.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Peter Maydell 8 years ago 57964855 487b406a

1 changed file

expand all

linux-user

arm

nwfpe

fpa11.c

linux-user/arm/nwfpe/fpa11.c

··· 137 137 unsigned int nRc = 0; 138 138 // unsigned long flags; 139 139 FPA11 *fpa11; 140 + unsigned int cp; 140 141 // save_flags(flags); sti(); 142 + 143 + /* Check that this is really an FPA11 instruction: the coprocessor 144 + * field in bits [11:8] must be 1 or 2. 145 + */ 146 + cp = (opcode >> 8) & 0xf; 147 + if (cp != 1 && cp != 2) { 148 + return 0; 149 + } 141 150 142 151 qemufpa=qfpa; 143 152 user_registers=qregs;