| Message ID | 1294783938-19629-7-git-send-email-peter.maydell@linaro.org |
|---|---|
| State | New |
| Headers | show |
On Tue, Jan 11, 2011 at 10:12:16PM +0000, Peter Maydell wrote: > When translating, the condexec bits for the TB are in the TB flags; > the CPUState condexec bits may be different. > > This patch fixes https://bugs.launchpad.net/bugs/604872 where we might > segfault if we took an exception in the middle of a TB with an IT > block, because when we came to retranslate in cpu_restore_state() > the CPUState condexec bits would have advanced compared to the start > of the TB and we would generate different (wrong) code. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > target-arm/translate.c | 6 +++--- > 1 files changed, 3 insertions(+), 3 deletions(-) Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> > diff --git a/target-arm/translate.c b/target-arm/translate.c > index bda5d47..4fe202d 100644 > --- a/target-arm/translate.c > +++ b/target-arm/translate.c > @@ -9075,8 +9075,8 @@ static inline void gen_intermediate_code_internal(CPUState *env, > dc->singlestep_enabled = env->singlestep_enabled; > dc->condjmp = 0; > dc->thumb = ARM_TBFLAG_THUMB(tb->flags); > - dc->condexec_mask = (env->condexec_bits & 0xf) << 1; > - dc->condexec_cond = env->condexec_bits >> 4; > + dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1; > + dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4; > #if !defined(CONFIG_USER_ONLY) > if (IS_M(env)) { > dc->user = ((env->v7m.exception == 0) && (env->v7m.control & 1)); > @@ -9105,7 +9105,7 @@ static inline void gen_intermediate_code_internal(CPUState *env, > gen_icount_start(); > /* Reset the conditional execution bits immediately. This avoids > complications trying to do it at the end of the block. */ > - if (env->condexec_bits) > + if (dc->condexec_mask || dc->condexec_cond) > { > TCGv tmp = new_tmp(); > tcg_gen_movi_i32(tmp, 0); > -- > 1.6.3.3 > > >
diff --git a/target-arm/translate.c b/target-arm/translate.c index bda5d47..4fe202d 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -9075,8 +9075,8 @@ static inline void gen_intermediate_code_internal(CPUState *env, dc->singlestep_enabled = env->singlestep_enabled; dc->condjmp = 0; dc->thumb = ARM_TBFLAG_THUMB(tb->flags); - dc->condexec_mask = (env->condexec_bits & 0xf) << 1; - dc->condexec_cond = env->condexec_bits >> 4; + dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1; + dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4; #if !defined(CONFIG_USER_ONLY) if (IS_M(env)) { dc->user = ((env->v7m.exception == 0) && (env->v7m.control & 1)); @@ -9105,7 +9105,7 @@ static inline void gen_intermediate_code_internal(CPUState *env, gen_icount_start(); /* Reset the conditional execution bits immediately. This avoids complications trying to do it at the end of the block. */ - if (env->condexec_bits) + if (dc->condexec_mask || dc->condexec_cond) { TCGv tmp = new_tmp(); tcg_gen_movi_i32(tmp, 0);
When translating, the condexec bits for the TB are in the TB flags; the CPUState condexec bits may be different. This patch fixes https://bugs.launchpad.net/bugs/604872 where we might segfault if we took an exception in the middle of a TB with an IT block, because when we came to retranslate in cpu_restore_state() the CPUState condexec bits would have advanced compared to the start of the TB and we would generate different (wrong) code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target-arm/translate.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)