gwj / at91sam9263 · Commits

Commit 2ce696baa6fc5d99522cf387b6a4913807fd43ed

Authored by Filip Navara
1 parent 9bd54a4a

Fix bugs reported by Juha Riihimäki <juha.riihimaki@nokia.com>: 

i) in function gen_bx_im, the last line (should be line 695 in your git HEAD) should be "tcg_gen_movi_i32..." instead of "tcg_gen_mov_i32". Otherwise BX/BLX immediate instructions will segfault QEMU.

ii) you have a resource leak in disas_vfp_insn; on line 3129 in your git HEAD, you have allocated a new temporary (addr) but if the if-expression on line 3129 is true, it will not be released - I fixed this by adding a "dead_tmp(addr);" line between lines 3141 and 3142 (i.e. the last line of the if-block).

iii) you have another resource issue in disas_thumb_insn; line 8306 should read "if (op != 0xf) dead_tmp(tmp);" instead of just plain "dead_tmp(tmp);" -- this is because in the above code the temporary variable tmp is not initialized if op==0xf and calling dead_tmp on it will cause problems.

Signed-off-by: Filip Navara <filip.navara@gmail.com>
Inline Side-by-side
Showing 1 changed file with 4 additions and 2 deletions
target-arm/translate.c
  View file @2ce696b
... ... @@ -692,7 +692,7 @@ static inline void gen_bx_im(DisasContext *s, uint32_t addr)
692 692 tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, thumb));
693 693 dead_tmp(tmp);
694 694 }
695   - tcg_gen_mov_i32(cpu_R[15], addr & ~1);
  695 + tcg_gen_movi_i32(cpu_R[15], addr & ~1);
696 696 }
697 697  
698 698 /* Set PC and Thumb state from var. var is marked as dead. */
... ... @@ -3139,6 +3139,7 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
3139 3139 gen_mov_F0_vreg(dp, rd);
3140 3140 gen_vfp_st(s, dp, addr);
3141 3141 }
  3142 + dead_tmp(addr);
3142 3143 } else {
3143 3144 /* load/store multiple */
3144 3145 if (dp)
... ... @@ -8303,7 +8304,8 @@ static void disas_thumb_insn(CPUState *env, DisasContext *s)
8303 8304 if (rd != 16) {
8304 8305 if (val) {
8305 8306 store_reg(s, rm, tmp2);
8306   - dead_tmp(tmp);
  8307 + if (op != 0xf)
  8308 + dead_tmp(tmp);
8307 8309 } else {
8308 8310 store_reg(s, rd, tmp);
8309 8311 dead_tmp(tmp2);
... ...