Hi all,
I have noticed that the decoding part in ARM/A32 does not verify the
opcodes for SWP instructions. The opcode field ([23:20]) for SWP
instructions should be 0 or 4, and QEMU does not check against these
values.
Other opcode values less than 8 are Undefined within the encoding
space of sychronization primitives (e.g., SWP, LDREX*). See section
A5.2.10 of ARMv7-A manual for reference. Because of the missing opcode
check, QEMU happily executes these Undefined cases as a SWP instruction.
The following fix adds proper opcode checks before assuming a valid SWP.
Best,
Onur
Signed-off-by: Onur Sahin <onursahi...@gmail.com>
---
target-arm/translate.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/target-arm/translate.c b/target-arm/translate.c
index bd5d5cb..fb31c12 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -8831,7 +8831,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int
insn)
}
}
tcg_temp_free_i32(addr);
- } else {
+ } else if (!(insn & 0x00B00000)) {
/* SWP instruction */
rm = (insn) & 0xf;
@@ -8852,6 +8852,9 @@ static void disas_arm_insn(DisasContext *s, unsigned int
insn)
tcg_temp_free_i32(addr);
store_reg(s, rd, tmp2);
}
+ else {
+ goto illegal_op;
+ }
}
} else {
int address_offset;
--
1.8.3.1
