qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] target/arm: Fix temp double-free in sve ldr/str
@ 2020-07-02 17:56 Richard Henderson
  2020-07-02 19:18 ` Philippe Mathieu-Daudé
  2020-07-03 13:31 ` Peter Maydell
  0 siblings, 2 replies; 4+ messages in thread
From: Richard Henderson @ 2020-07-02 17:56 UTC (permalink / raw)
  To: qemu-devel; +Cc: peter.maydell

The temp that gets assigned to clean_addr has been allocated with
new_tmp_a64, which means that it will be freed at the end of the
instruction.  Freeing it earlier leads to assertion failure.

The loop creates a complication, in which we allocate a new local
temp, which does need freeing, and the final code path is shared
between the loop and non-loop.

Fix this complication by adding new_tmp_a64_local so that the new
local temp is freed at the end, and can be treated exactly like
the non-loop path.

Fixes: bba87d0a0f4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/translate-a64.h | 1 +
 target/arm/translate-a64.c | 6 ++++++
 target/arm/translate-sve.c | 8 ++------
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index 49e4865918..647f0c74f6 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -30,6 +30,7 @@ void unallocated_encoding(DisasContext *s);
     } while (0)
 
 TCGv_i64 new_tmp_a64(DisasContext *s);
+TCGv_i64 new_tmp_a64_local(DisasContext *s);
 TCGv_i64 new_tmp_a64_zero(DisasContext *s);
 TCGv_i64 cpu_reg(DisasContext *s, int reg);
 TCGv_i64 cpu_reg_sp(DisasContext *s, int reg);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 73d753f11f..8c0764957c 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -461,6 +461,12 @@ TCGv_i64 new_tmp_a64(DisasContext *s)
     return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_new_i64();
 }
 
+TCGv_i64 new_tmp_a64_local(DisasContext *s)
+{
+    assert(s->tmp_a64_count < TMP_A64_MAX);
+    return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_local_new_i64();
+}
+
 TCGv_i64 new_tmp_a64_zero(DisasContext *s)
 {
     TCGv_i64 t = new_tmp_a64(s);
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index f318ca265f..08f0fd15b2 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -4372,9 +4372,8 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
 
         /* Copy the clean address into a local temp, live across the loop. */
         t0 = clean_addr;
-        clean_addr = tcg_temp_local_new_i64();
+        clean_addr = new_tmp_a64_local(s);
         tcg_gen_mov_i64(clean_addr, t0);
-        tcg_temp_free_i64(t0);
 
         gen_set_label(loop);
 
@@ -4422,7 +4421,6 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         tcg_gen_st_i64(t0, cpu_env, vofs + len_align);
         tcg_temp_free_i64(t0);
     }
-    tcg_temp_free_i64(clean_addr);
 }
 
 /* Similarly for stores.  */
@@ -4463,9 +4461,8 @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
 
         /* Copy the clean address into a local temp, live across the loop. */
         t0 = clean_addr;
-        clean_addr = tcg_temp_local_new_i64();
+        clean_addr = new_tmp_a64_local(s);
         tcg_gen_mov_i64(clean_addr, t0);
-        tcg_temp_free_i64(t0);
 
         gen_set_label(loop);
 
@@ -4509,7 +4506,6 @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         }
         tcg_temp_free_i64(t0);
     }
-    tcg_temp_free_i64(clean_addr);
 }
 
 static bool trans_LDR_zri(DisasContext *s, arg_rri *a)
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PULL 0/2] tcg patch queue
@ 2020-07-06 18:52 Richard Henderson
  2020-07-06 18:52 ` [PATCH] target/arm: Fix temp double-free in sve ldr/str Richard Henderson
  0 siblings, 1 reply; 4+ messages in thread
From: Richard Henderson @ 2020-07-06 18:52 UTC (permalink / raw)
  To: qemu-devel; +Cc: peter.maydell

The following changes since commit eb6490f544388dd24c0d054a96dd304bc7284450:

  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200703' into staging (2020-07-04 16:08:41 +0100)

are available in the Git repository at:

  https://github.com/rth7680/qemu.git tags/pull-tcg-20200706

for you to fetch changes up to 852f933e482518797f7785a2e017a215b88df815:

  tcg: Fix do_nonatomic_op_* vs signed operations (2020-07-06 10:58:19 -0700)

----------------------------------------------------------------
Fix for ppc shifts
Fix for non-parallel atomic ops

----------------------------------------------------------------
Catherine A. Frederick (1):
      tcg/ppc: Sanitize immediate shifts

Richard Henderson (1):
      tcg: Fix do_nonatomic_op_* vs signed operations

 tcg/ppc/tcg-target.inc.c | 15 ++++++++++-----
 tcg/tcg-op.c             | 10 ++++++----
 2 files changed, 16 insertions(+), 9 deletions(-)


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-07-06 18:53 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-02 17:56 [PATCH] target/arm: Fix temp double-free in sve ldr/str Richard Henderson
2020-07-02 19:18 ` Philippe Mathieu-Daudé
2020-07-03 13:31 ` Peter Maydell
  -- strict thread matches above, loose matches on Subject: below --
2020-07-06 18:52 [PULL 0/2] tcg patch queue Richard Henderson
2020-07-06 18:52 ` [PATCH] target/arm: Fix temp double-free in sve ldr/str Richard Henderson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).