artemist/yuzu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

dyncom: Read-after-write in SMLA

Browse source 
In the case when RD === RN, RD was updated before AddOverflow was called
to check for an overflow, resulting in an incorrect state of the Q flag.
This commit is contained in:
MerryMage 2016-08-22 15:06:35 +01:00
parent 7b4dcacbb2
commit 15b2eec4bd
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/core/arm/dyncom/arm_dyncom_interpreter.cpp
View file

@ -2820,10 +2820,12 @@ unsigned InterpreterMainLoop(ARMul_State* cpu) {
operand2 = (BIT(RS, 15)) ? (BITS(RS, 0, 15) | 0xffff0000) : BITS(RS, 0, 15); operand2 = (BIT(RS, 15)) ? (BITS(RS, 0, 15) | 0xffff0000) : BITS(RS, 0, 15);
else else
operand2 = (BIT(RS, 31)) ? (BITS(RS, 16, 31) | 0xffff0000) : BITS(RS, 16, 31); operand2 = (BIT(RS, 31)) ? (BITS(RS, 16, 31) | 0xffff0000) : BITS(RS, 16, 31);
RD = operand1 * operand2 + RN;
if (AddOverflow(operand1 * operand2, RN, RD)) u32 product = operand1 * operand2;
u32 result = product + RN;
if (AddOverflow(product, RN, result))
cpu->Cpsr |= (1 << 27); cpu->Cpsr |= (1 << 27);
RD = result;
} }
cpu->Reg[15] += cpu->GetInstructionSize(); cpu->Reg[15] += cpu->GetInstructionSize();
INC_PC(sizeof(smla_inst)); INC_PC(sizeof(smla_inst));