diff options
author | Peter Maydell <peter.maydell@linaro.org> | 2018-05-11 15:41:29 +0100 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2018-05-11 15:41:29 +0100 |
commit | c74e62ee3e2dc2955e07d004c71badecb68a84eb (patch) | |
tree | d20da427e30c03e58e7ff560b29b012a6fb31d18 /target/arm/translate.c | |
parent | 6d7cde809d915e14728eda0af1c0618eb5710a96 (diff) | |
parent | 5b4f1d2db9fb0e24549054ee58c7a7d8f84ddd6e (diff) | |
download | qemu-master.tar.gz |
* Fix all next_page checks for overflow.
* Convert six targets to the translator loop.
# gpg: Signature made Wed 09 May 2018 18:20:43 BST
# gpg: using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F
* remotes/rth/tags/cota-target-pull-request: (28 commits)
target/riscv: convert to TranslatorOps
target/riscv: convert to DisasContextBase
target/riscv: convert to DisasJumpType
target/openrisc: convert to TranslatorOps
target/openrisc: convert to DisasContextBase
target/s390x: convert to TranslatorOps
target/s390x: convert to DisasContextBase
target/s390x: convert to DisasJumpType
target/mips: convert to TranslatorOps
target/mips: use *ctx for DisasContext
target/mips: convert to DisasContextBase
target/mips: convert to DisasJumpType
target/mips: use lookup_and_goto_ptr on BS_STOP
target/sparc: convert to TranslatorOps
target/sparc: convert to DisasContextBase
target/sparc: convert to DisasJumpType
target/sh4: convert to TranslatorOps
translator: merge max_insns into DisasContextBase
target/mips: avoid integer overflow in next_page PC check
target/s390x: avoid integer overflow in next_page PC check
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'target/arm/translate.c')
-rw-r--r-- | target/arm/translate.c | 20 |
1 files changed, 8 insertions, 12 deletions
diff --git a/target/arm/translate.c b/target/arm/translate.c index ad208867a7..731cf327a1 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -9930,7 +9930,7 @@ static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn) return false; } - if ((insn >> 11) == 0x1e && (s->pc < s->next_page_start - 3)) { + if ((insn >> 11) == 0x1e && s->pc - s->page_start < TARGET_PAGE_SIZE - 3) { /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix * is not on the next page; we merge this into a 32-bit * insn. @@ -12243,8 +12243,7 @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s) return !thumb_insn_is_16bit(s, insn); } -static int arm_tr_init_disas_context(DisasContextBase *dcbase, - CPUState *cs, int max_insns) +static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) { DisasContext *dc = container_of(dcbase, DisasContext, base); CPUARMState *env = cs->env_ptr; @@ -12301,19 +12300,18 @@ static int arm_tr_init_disas_context(DisasContextBase *dcbase, dc->is_ldex = false; dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */ - dc->next_page_start = - (dc->base.pc_first & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; + dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK; /* If architectural single step active, limit to 1. */ if (is_singlestepping(dc)) { - max_insns = 1; + dc->base.max_insns = 1; } /* ARM is a fixed-length ISA. Bound the number of insns to execute to those left on the page. */ if (!dc->thumb) { - int bound = (dc->next_page_start - dc->base.pc_first) / 4; - max_insns = MIN(max_insns, bound); + int bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4; + dc->base.max_insns = MIN(dc->base.max_insns, bound); } cpu_F0s = tcg_temp_new_i32(); @@ -12324,8 +12322,6 @@ static int arm_tr_init_disas_context(DisasContextBase *dcbase, cpu_V1 = cpu_F1d; /* FIXME: cpu_M0 can probably be the same as cpu_V0. */ cpu_M0 = tcg_temp_new_i64(); - - return max_insns; } static void arm_tr_tb_start(DisasContextBase *dcbase, CPUState *cpu) @@ -12584,8 +12580,8 @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) * but isn't very efficient). */ if (dc->base.is_jmp == DISAS_NEXT - && (dc->pc >= dc->next_page_start - || (dc->pc >= dc->next_page_start - 3 + && (dc->pc - dc->page_start >= TARGET_PAGE_SIZE + || (dc->pc - dc->page_start >= TARGET_PAGE_SIZE - 3 && insn_crosses_page(env, dc)))) { dc->base.is_jmp = DISAS_TOO_MANY; } |