gwj / at91sam9263 · Commits

Commit d07bde88a52bf293c3f8846cfd162e0a57e1557c

Authored by blueswir1
1 parent 52df269c

Fix code generation buffer overflow reported by TeLeMan 


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3805 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 4 changed files with 20 additions and 7 deletions
cpu-exec.c
  View file @d07bde8
... ... @@ -133,7 +133,7 @@ static TranslationBlock *tb_find_slow(target_ulong pc,
133 133 tb->tc_ptr = tc_ptr;
134 134 tb->cs_base = cs_base;
135 135 tb->flags = flags;
136   - cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
  136 + cpu_gen_code(env, tb, &code_gen_size);
137 137 code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
138 138  
139 139 /* check next page if needed */
... ...
exec-all.h
  View file @d07bde8
... ... @@ -64,8 +64,9 @@ extern int loglevel;
64 64 int gen_intermediate_code(CPUState *env, struct TranslationBlock *tb);
65 65 int gen_intermediate_code_pc(CPUState *env, struct TranslationBlock *tb);
66 66 void dump_ops(const uint16_t *opc_buf, const uint32_t *opparam_buf);
  67 +unsigned long code_gen_max_block_size(void);
67 68 int cpu_gen_code(CPUState *env, struct TranslationBlock *tb,
68   - int max_code_size, int *gen_code_size_ptr);
  69 + int *gen_code_size_ptr);
69 70 int cpu_restore_state(struct TranslationBlock *tb,
70 71 CPUState *env, unsigned long searched_pc,
71 72 void *puc);
... ... @@ -94,7 +95,6 @@ static inline int tlb_set_page(CPUState *env, target_ulong vaddr,
94 95 return tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
95 96 }
96 97  
97   -#define CODE_GEN_MAX_SIZE 65536
98 98 #define CODE_GEN_ALIGN 16 /* must be >= of the size of a icache line */
99 99  
100 100 #define CODE_GEN_PHYS_HASH_BITS 15
... ...
... ... @@ -56,7 +56,7 @@
56 56 #endif
57 57  
58 58 /* threshold to flush the translated code buffer */
59   -#define CODE_GEN_BUFFER_MAX_SIZE (CODE_GEN_BUFFER_SIZE - CODE_GEN_MAX_SIZE)
  59 +#define CODE_GEN_BUFFER_MAX_SIZE (CODE_GEN_BUFFER_SIZE - code_gen_max_block_size())
60 60  
61 61 #define SMC_BITMAP_USE_THRESHOLD 10
62 62  
... ... @@ -622,7 +622,7 @@ static void tb_gen_code(CPUState *env,
622 622 tb->cs_base = cs_base;
623 623 tb->flags = flags;
624 624 tb->cflags = cflags;
625   - cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
  625 + cpu_gen_code(env, tb, &code_gen_size);
626 626 code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
627 627  
628 628 /* check next page if needed */
... ...
translate-all.c
  View file @d07bde8
... ... @@ -132,14 +132,27 @@ static void dyngen_labels(long *gen_labels, int nb_gen_labels,
132 132 }
133 133 }
134 134  
  135 +unsigned long code_gen_max_block_size(void)
  136 +{
  137 + static unsigned long max;
  138 +
  139 + if (max == 0) {
  140 +#define DEF(s, n, copy_size) max = copy_size > max? copy_size : max;
  141 +#include "opc.h"
  142 +#undef DEF
  143 + max *= OPC_MAX_SIZE;
  144 + }
  145 +
  146 + return max;
  147 +}
  148 +
135 149 /* return non zero if the very first instruction is invalid so that
136 150 the virtual CPU can trigger an exception.
137 151  
138 152 '*gen_code_size_ptr' contains the size of the generated code (host
139 153 code).
140 154 */
141   -int cpu_gen_code(CPUState *env, TranslationBlock *tb,
142   - int max_code_size, int *gen_code_size_ptr)
  155 +int cpu_gen_code(CPUState *env, TranslationBlock *tb, int *gen_code_size_ptr)
143 156 {
144 157 uint8_t *gen_code_buf;
145 158 int gen_code_size;
... ...