From: notaz Date: Sat, 29 Jul 2023 23:31:02 +0000 (+0300) Subject: dma: don't copy out of range X-Git-Tag: r24l~269 X-Git-Url: https://notaz.gp2x.de/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d01bb9047a4d17c2be0da31904eb7696d610091f;p=pcsx_rearmed.git dma: don't copy out of range it should wrap, but that's not practical so just limit for now libretro/pcsx_rearmed#740 --- diff --git a/libpcsxcore/cdrom.c b/libpcsxcore/cdrom.c index c092f2ca..7bc57cff 100644 --- a/libpcsxcore/cdrom.c +++ b/libpcsxcore/cdrom.c @@ -1565,7 +1565,7 @@ void cdrWrite3(unsigned char rt) { } void psxDma3(u32 madr, u32 bcr, u32 chcr) { - u32 cdsize; + u32 cdsize, max_words; int size; u8 *ptr; @@ -1580,7 +1580,7 @@ void psxDma3(u32 madr, u32 bcr, u32 chcr) { switch (chcr & 0x71000000) { case 0x11000000: - ptr = (u8 *)PSXM(madr); + ptr = getDmaRam(madr, &max_words); if (ptr == INVALID_PTR) { CDR_LOG_I("psxDma3() Log: *** DMA 3 *** NULL Pointer!\n"); break; @@ -1597,6 +1597,8 @@ void psxDma3(u32 madr, u32 bcr, u32 chcr) { size = DATA_SIZE - cdr.FifoOffset; if (size > cdsize) size = cdsize; + if (size > max_words * 4) + size = max_words * 4; if (size > 0) { memcpy(ptr, cdr.Transfer + cdr.FifoOffset, size); diff --git a/libpcsxcore/psxdma.c b/libpcsxcore/psxdma.c index 30aa9bdb..e15f0185 100644 --- a/libpcsxcore/psxdma.c +++ b/libpcsxcore/psxdma.c @@ -24,6 +24,10 @@ #include "psxdma.h" #include "gpu.h" +#ifndef min +#define min(a, b) ((b) < (a) ? (b) : (a)) +#endif + // Dma0/1 in Mdec.c // Dma3 in CdRom.c @@ -36,15 +40,15 @@ void spuInterrupt() { } void psxDma4(u32 madr, u32 bcr, u32 chcr) { // SPU + u32 words, words_max, size; u16 *ptr; - u32 words; switch (chcr) { case 0x01000201: //cpu to spu transfer #ifdef PSXDMA_LOG PSXDMA_LOG("*** DMA4 SPU - mem2spu *** %x addr = %x size = %x\n", chcr, madr, bcr); #endif - ptr = (u16 *)PSXM(madr); + ptr = getDmaRam(madr, &words_max); if (ptr == INVALID_PTR) { #ifdef CPU_LOG CPU_LOG("*** DMA4 SPU - mem2spu *** NULL Pointer!!!\n"); @@ -52,8 +56,9 @@ void psxDma4(u32 madr, u32 bcr, u32 chcr) { // SPU break; } words = (bcr >> 16) * (bcr & 0xffff); - SPU_writeDMAMem(ptr, words * 2, psxRegs.cycle); - HW_DMA4_MADR = SWAPu32(madr + words * 4); + size = min(words, words_max) * 2; + SPU_writeDMAMem(ptr, size, psxRegs.cycle); + HW_DMA4_MADR = SWAPu32((madr & ~3) + words * 4); SPUDMA_INT(words * 4); return; @@ -61,7 +66,7 @@ void psxDma4(u32 madr, u32 bcr, u32 chcr) { // SPU #ifdef PSXDMA_LOG PSXDMA_LOG("*** DMA4 SPU - spu2mem *** %x addr = %x size = %x\n", chcr, madr, bcr); #endif - ptr = (u16 *)PSXM(madr); + ptr = getDmaRam(madr, &words_max); if (ptr == INVALID_PTR) { #ifdef CPU_LOG CPU_LOG("*** DMA4 SPU - spu2mem *** NULL Pointer!!!\n"); @@ -69,7 +74,8 @@ void psxDma4(u32 madr, u32 bcr, u32 chcr) { // SPU break; } words = (bcr >> 16) * (bcr & 0xffff); - SPU_readDMAMem(ptr, words * 2, psxRegs.cycle); + size = min(words, words_max) * 2; + SPU_readDMAMem(ptr, size, psxRegs.cycle); psxCpu->Clear(madr, words); HW_DMA4_MADR = SWAPu32(madr + words * 4); @@ -127,17 +133,16 @@ static u32 gpuDmaChainSize(u32 addr) { } void psxDma2(u32 madr, u32 bcr, u32 chcr) { // GPU - u32 *ptr, madr_next, *madr_next_p; + u32 *ptr, madr_next, *madr_next_p, size; + u32 words, words_max, words_copy; int do_walking; - u32 words; - u32 size; switch (chcr) { case 0x01000200: // vram2mem #ifdef PSXDMA_LOG PSXDMA_LOG("*** DMA2 GPU - vram2mem *** %lx addr = %lx size = %lx\n", chcr, madr, bcr); #endif - ptr = (u32 *)PSXM(madr); + ptr = getDmaRam(madr, &words_max); if (ptr == INVALID_PTR) { #ifdef CPU_LOG CPU_LOG("*** DMA2 GPU - vram2mem *** NULL Pointer!!!\n"); @@ -146,10 +151,11 @@ void psxDma2(u32 madr, u32 bcr, u32 chcr) { // GPU } // BA blocks * BS words (word = 32-bits) words = (bcr >> 16) * (bcr & 0xffff); - GPU_readDataMem(ptr, words); - psxCpu->Clear(madr, words); + words_copy = min(words, words_max); + GPU_readDataMem(ptr, words_copy); + psxCpu->Clear(madr, words_copy); - HW_DMA2_MADR = SWAPu32(madr + words * 4); + HW_DMA2_MADR = SWAPu32((madr & ~3) + words * 4); // already 32-bit word size ((size * 4) / 4) GPUDMA_INT(words / 4); @@ -159,7 +165,7 @@ void psxDma2(u32 madr, u32 bcr, u32 chcr) { // GPU #ifdef PSXDMA_LOG PSXDMA_LOG("*** DMA 2 - GPU mem2vram *** %lx addr = %lx size = %lx\n", chcr, madr, bcr); #endif - ptr = (u32 *)PSXM(madr); + ptr = getDmaRam(madr, &words_max); if (ptr == INVALID_PTR) { #ifdef CPU_LOG CPU_LOG("*** DMA2 GPU - mem2vram *** NULL Pointer!!!\n"); @@ -168,9 +174,9 @@ void psxDma2(u32 madr, u32 bcr, u32 chcr) { // GPU } // BA blocks * BS words (word = 32-bits) words = (bcr >> 16) * (bcr & 0xffff); - GPU_writeDataMem(ptr, words); + GPU_writeDataMem(ptr, min(words, words_max)); - HW_DMA2_MADR = SWAPu32(madr + words * 4); + HW_DMA2_MADR = SWAPu32((madr & ~3) + words * 4); // already 32-bit word size ((size * 4) / 4) GPUDMA_INT(words / 4); diff --git a/libpcsxcore/psxdma.h b/libpcsxcore/psxdma.h index 28495fa8..eaddb388 100644 --- a/libpcsxcore/psxdma.h +++ b/libpcsxcore/psxdma.h @@ -79,6 +79,17 @@ void gpuInterrupt(); void spuInterrupt(); void gpuotcInterrupt(); +static inline void *getDmaRam(u32 madr, u32 *max_words) +{ + // this should wrap instead of limit + if (!(madr & 0x800000)) { + madr &= 0x1ffffc; + *max_words = (0x200000 - madr) / 4; + return psxM + madr; + } + return INVALID_PTR; +} + #ifdef __cplusplus } #endif