Message ID | 20191022140016.918371-1-clement.deschamps@greensocs.com |
---|---|
State | New |
Headers | show |
Series | translate-all: fix uninitialized tb->orig_tb | expand |
On 10/22/19 10:00 AM, Clement Deschamps wrote: > This fixes a segmentation fault in icount mode when executing from an IO region. > > TB is marked as CF_NOCACHE but tb->orig_tb is not initialized (equals > previous value in code_gen_buffer). > > The issue happens in cpu_io_recompile() when it tries to invalidate orig_tb. > > Signed-off-by: Clement Deschamps <clement.deschamps@greensocs.com> > --- > accel/tcg/translate-all.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c > index 66d4bc4341..f9b7ba159d 100644 > --- a/accel/tcg/translate-all.c > +++ b/accel/tcg/translate-all.c > @@ -1722,6 +1722,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, > tb->cs_base = cs_base; > tb->flags = flags; > tb->cflags = cflags; > + tb->orig_tb = NULL; Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Yep, the key is the the I/O region, when phys_pc == -1; previously the only place that set CF_NOCACHE was cpu_exec_nocache, which is where orig_tb is normally set. Queued. r~
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c index 66d4bc4341..f9b7ba159d 100644 --- a/accel/tcg/translate-all.c +++ b/accel/tcg/translate-all.c @@ -1722,6 +1722,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, tb->cs_base = cs_base; tb->flags = flags; tb->cflags = cflags; + tb->orig_tb = NULL; tb->trace_vcpu_dstate = *cpu->trace_dstate; tcg_ctx->tb_cflags = cflags; tb_overflow:
This fixes a segmentation fault in icount mode when executing from an IO region. TB is marked as CF_NOCACHE but tb->orig_tb is not initialized (equals previous value in code_gen_buffer). The issue happens in cpu_io_recompile() when it tries to invalidate orig_tb. Signed-off-by: Clement Deschamps <clement.deschamps@greensocs.com> --- accel/tcg/translate-all.c | 1 + 1 file changed, 1 insertion(+)