Skip to content

Commit a303fc6

Browse files
happppphappppp
committed
namcos21_dsp: saftety mask for possible array oob
1 parent 4709cf7 commit a303fc6

6 files changed

Lines changed: 26 additions & 18 deletions

File tree

‎src/mame/namco/namcos21.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -933,7 +933,7 @@ ROM_START( winrun )
933933
ROM_LOAD16_BYTE( "wr1-gd0u-2.1p", 0x00000, 0x40000, CRC(9752eef5) SHA1(d6df0faf9c2696247bdf463f53c1e474ec595dd0) )
934934
ROM_LOAD16_BYTE( "wr1-gd0l-2.3p", 0x00001, 0x40000, CRC(349c95cc) SHA1(8898eecf5918485ec683900520f123483077df28) )
935935

936-
ROM_REGION16_BE( 0x80000, "namcos21dsp:point16", 0 ) /* 3d objects */
936+
ROM_REGION16_BE( 0x40000, "namcos21dsp:point16", 0 ) /* 3d objects */
937937
ROM_LOAD16_BYTE( "wr1-pt0u.8j", 0x00000, 0x20000, CRC(7ec4cf6b) SHA1(92ec92567b9f7321efb4a3724cbcdba216eb22f9) )
938938
ROM_LOAD16_BYTE( "wr1-pt0l.8d", 0x00001, 0x20000, CRC(58c14b73) SHA1(e34a26866cd870743e166669f7fa5915a82104e9) )
939939

‎src/mame/namco/namcos21_de.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -744,7 +744,7 @@ ROM_START( driveyes )
744744
ROM_LOAD16_BYTE( "de1-data-u.3a", 0x00000, 0x80000, CRC(fe65d2ab) SHA1(dbe962dda7efa60357fa3a684a265aaad49df5b5) )
745745
ROM_LOAD16_BYTE( "de1-data-l.1a", 0x00001, 0x80000, CRC(9bb37aca) SHA1(7f5dffc95cadcf12f53ff7944920afc25ed3cf68) )
746746

747-
ROM_REGION16_BE( 0xc0000, "pcb_1:namcos21dsp:point16", 0 ) /* 3d objects */
747+
ROM_REGION16_BE( 0x100000, "pcb_1:namcos21dsp:point16", ROMREGION_ERASE00 ) /* 3d objects */
748748
ROM_LOAD16_BYTE( "de1-pt0-ub.8j", 0x00000, 0x20000, CRC(3b6b746d) SHA1(40c992ef4cf5187b30aba42c5fe7ce0f8f02bee0) )
749749
ROM_LOAD16_BYTE( "de1-pt0-lb.8d", 0x00001, 0x20000, CRC(9c5c477e) SHA1(c8ae8a663227d636d35bd5f432d23f05d6695942) )
750750
ROM_LOAD16_BYTE( "de1-pt1-u.8l", 0x40000, 0x20000, CRC(23bc72a1) SHA1(083e2955ae2f88d1ad461517b47054d64375b46e) )
@@ -787,7 +787,7 @@ ROM_START( driveyes )
787787
ROM_LOAD16_BYTE( "de1-data-u.3a", 0x00000, 0x80000, CRC(fe65d2ab) SHA1(dbe962dda7efa60357fa3a684a265aaad49df5b5) )
788788
ROM_LOAD16_BYTE( "de1-data-l.1a", 0x00001, 0x80000, CRC(9bb37aca) SHA1(7f5dffc95cadcf12f53ff7944920afc25ed3cf68) )
789789

790-
ROM_REGION16_BE( 0xc0000, "pcb_0:namcos21dsp:point16", 0 ) /* 3d objects */
790+
ROM_REGION16_BE( 0x100000, "pcb_0:namcos21dsp:point16", ROMREGION_ERASE00 ) /* 3d objects */
791791
ROM_LOAD16_BYTE( "de1-pt0-ub.8j", 0x00000, 0x20000, CRC(3b6b746d) SHA1(40c992ef4cf5187b30aba42c5fe7ce0f8f02bee0) )
792792
ROM_LOAD16_BYTE( "de1-pt0-lb.8d", 0x00001, 0x20000, CRC(9c5c477e) SHA1(c8ae8a663227d636d35bd5f432d23f05d6695942) )
793793
ROM_LOAD16_BYTE( "de1-pt1-u.8l", 0x40000, 0x20000, CRC(23bc72a1) SHA1(083e2955ae2f88d1ad461517b47054d64375b46e) )
@@ -830,7 +830,7 @@ ROM_START( driveyes )
830830
ROM_LOAD16_BYTE( "de1-data-u.3a", 0x00000, 0x80000, CRC(fe65d2ab) SHA1(dbe962dda7efa60357fa3a684a265aaad49df5b5) )
831831
ROM_LOAD16_BYTE( "de1-data-l.1a", 0x00001, 0x80000, CRC(9bb37aca) SHA1(7f5dffc95cadcf12f53ff7944920afc25ed3cf68) )
832832

833-
ROM_REGION16_BE( 0xc0000, "pcb_2:namcos21dsp:point16", 0 ) /* 3d objects */
833+
ROM_REGION16_BE( 0x100000, "pcb_2:namcos21dsp:point16", ROMREGION_ERASE00 ) /* 3d objects */
834834
ROM_LOAD16_BYTE( "de1-pt0-ub.8j", 0x00000, 0x20000, CRC(3b6b746d) SHA1(40c992ef4cf5187b30aba42c5fe7ce0f8f02bee0) )
835835
ROM_LOAD16_BYTE( "de1-pt0-lb.8d", 0x00001, 0x20000, CRC(9c5c477e) SHA1(c8ae8a663227d636d35bd5f432d23f05d6695942) )
836836
ROM_LOAD16_BYTE( "de1-pt1-u.8l", 0x40000, 0x20000, CRC(23bc72a1) SHA1(083e2955ae2f88d1ad461517b47054d64375b46e) )

‎src/mame/namco/namcos21_dsp.cpp‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ used by Winning Run series, Driver's Eyes
77
88
TODO:
99
- handle protection properly and with callbacks
10+
- poly_reset_r (the DSP BIO pin) can't be for flushing polys, it's most likely
11+
a busy signal from the renderer
1012
1113
*/
1214

@@ -29,6 +31,9 @@ void namcos21_dsp_device::device_start()
2931
{
3032
m_suspend_timer = timer_alloc(FUNC(namcos21_dsp_device::suspend_callback), this);
3133

34+
m_pointrom_mask = m_ptrom16.length() - 1;
35+
assert((m_pointrom_mask & (m_pointrom_mask + 1)) == 0);
36+
3237
m_pointram_idx = 0;
3338
m_pointram_control = 0;
3439
m_poly_index = 0;
@@ -149,18 +154,18 @@ void namcos21_dsp_device::dsp_pointrom_addr_w(offs_t offset, u16 data)
149154
if (offset == 0)
150155
{
151156
// port 8
152-
m_pointrom_addr = data;
157+
m_pointrom_addr = (m_pointrom_addr & ~0xffff) | data;
153158
}
154159
else
155160
{
156161
// port 9
157-
m_pointrom_addr |= (data << 16);
162+
m_pointrom_addr = (m_pointrom_addr & 0xffff) | (data << 16);
158163
}
159164
}
160165

161166
u16 namcos21_dsp_device::dsp_pointrom_data_r()
162167
{
163-
u16 data = m_ptrom16[m_pointrom_addr];
168+
u16 data = m_ptrom16[m_pointrom_addr & m_pointrom_mask];
164169

165170
if (!machine().side_effects_disabled())
166171
m_pointrom_addr++;
@@ -247,12 +252,12 @@ void namcos21_dsp_device::dsp_io(address_map &map)
247252

248253
void namcos21_dsp_device::device_add_mconfig(machine_config &config)
249254
{
250-
tms320c25_device& dsp(TMS320C25(config, m_dsp, 40_MHz_XTAL)); // 40 MHz oscillator on DSP board
251-
dsp.set_addrmap(AS_PROGRAM, &namcos21_dsp_device::dsp_program);
252-
dsp.set_addrmap(AS_DATA, &namcos21_dsp_device::dsp_data);
253-
dsp.set_addrmap(AS_IO, &namcos21_dsp_device::dsp_io);
254-
dsp.bio_in_cb().set(FUNC(namcos21_dsp_device::poly_reset_r));
255-
dsp.xf_out_cb().set_nop();
255+
TMS320C25(config, m_dsp, 40_MHz_XTAL); // 40 MHz oscillator on DSP board
256+
m_dsp->set_addrmap(AS_PROGRAM, &namcos21_dsp_device::dsp_program);
257+
m_dsp->set_addrmap(AS_DATA, &namcos21_dsp_device::dsp_data);
258+
m_dsp->set_addrmap(AS_IO, &namcos21_dsp_device::dsp_io);
259+
m_dsp->bio_in_cb().set(FUNC(namcos21_dsp_device::poly_reset_r));
260+
m_dsp->xf_out_cb().set_nop();
256261
}
257262

258263
void namcos21_dsp_device::pointram_control_w(offs_t offset, u16 data, u16 mem_mask)

‎src/mame/namco/namcos21_dsp.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ class namcos21_dsp_device : public device_t
4343
static constexpr unsigned PTRAM_SIZE = 0x20000;
4444
static constexpr unsigned MAX_POLY_PARAM = 1+256*3;
4545

46-
required_device<cpu_device> m_dsp;
46+
required_device<tms320c25_device> m_dsp;
4747
required_shared_ptr<u16> m_dspbios;
4848
required_shared_ptr<u16> m_polydata;
4949
required_region_ptr<u16> m_ptrom16;
@@ -58,6 +58,7 @@ class namcos21_dsp_device : public device_t
5858
u16 m_poly_buf[MAX_POLY_PARAM]{};
5959
int m_poly_index;
6060
u32 m_pointrom_addr;
61+
u32 m_pointrom_mask;
6162
u16 m_dsp_complete;
6263

6364
void flush_poly();

‎src/mame/namco/namcos21_dsp_c67.cpp‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ namcos21_dsp_c67_device::namcos21_dsp_c67_device(const machine_config &mconfig,
3434

3535
void namcos21_dsp_c67_device::device_start()
3636
{
37+
assert(m_ptrom24.length() == 0x100000);
38+
3739
m_dspram16 = make_unique_clear<u16 []>(0x10000/2); // 0x8000 16-bit words
3840
save_pointer(NAME(m_dspram16), 0x10000/2);
3941

@@ -130,7 +132,7 @@ void namcos21_dsp_c67_device::device_add_mconfig(machine_config &config)
130132
m_c67slave[i]->set_addrmap(AS_IO, &namcos21_dsp_c67_device::slave_dsp_io);
131133
m_c67slave[i]->hold_in_cb().set_constant(0);
132134
m_c67slave[i]->hold_ack_out_cb().set_nop();
133-
m_c67slave[i]->xf_out_cb().set(FUNC(namcos21_dsp_c67_device::slave_XF_output_w));
135+
m_c67slave[i]->xf_out_cb().set(FUNC(namcos21_dsp_c67_device::slave_xf_output_w));
134136

135137
// instead of the master splitting the workload across the 4 slaves, the emulation
136138
// currently only uses one slave DSP clocked at 4x the normal rate
@@ -633,9 +635,9 @@ void namcos21_dsp_c67_device::slave_port3_w(u16 data)
633635
// 0=busy, 1=ready?
634636
}
635637

636-
void namcos21_dsp_c67_device::slave_XF_output_w(u16 data)
638+
void namcos21_dsp_c67_device::slave_xf_output_w(u16 data)
637639
{
638-
if (ENABLE_LOGGING) logerror("%s :slaveXF(%d)\n", machine().describe_context(), data);
640+
if (ENABLE_LOGGING) logerror("%s :slave_xf(%d)\n", machine().describe_context(), data);
639641
}
640642

641643
u16 namcos21_dsp_c67_device::slave_portf_r()

‎src/mame/namco/namcos21_dsp_c67.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ class namcos21_dsp_c67_device : public device_t
131131
u16 slave_port2_r();
132132
u16 slave_port3_r();
133133
void slave_port3_w(u16 data);
134-
void slave_XF_output_w(u16 data);
134+
void slave_xf_output_w(u16 data);
135135
u16 slave_portf_r();
136136

137137
void master_dsp_data(address_map &map) ATTR_COLD;

0 commit comments

Comments
 (0)