commit: c61676a2378adeebe401e204510cecd9077c4358
Author: Jason A. Donenfeld <zx2c4 <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 15 14:09:33 2018 +0000
Commit: Jason Donenfeld <zx2c4 <AT> gentoo <DOT> org>
CommitDate: Fri Jun 15 14:10:00 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c61676a2
app-emulation/qemu: fix major TCG crash
This is a custom backport of a patch being prepared for 2.12.1.
Package-Manager: Portage-2.3.40, Repoman-2.3.9
.../qemu-2.12.0-tcg-instruction-overflow.patch | 183 +++++++++++++++++++++
...qemu-2.12.0-r2.ebuild => qemu-2.12.0-r3.ebuild} | 1 +
2 files changed, 184 insertions(+)
diff --git
a/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch
b/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch
new file mode 100644
index 00000000000..24df138a777
--- /dev/null
+++ b/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch
@@ -0,0 +1,183 @@
+diff -ru qemu-2.12.0/tcg/aarch64/tcg-target.inc.c
qemu-2.12.0-modified/tcg/aarch64/tcg-target.inc.c
+--- qemu-2.12.0/tcg/aarch64/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/aarch64/tcg-target.inc.c 2018-06-15
15:47:20.557969818 +0200
+@@ -1733,7 +1733,7 @@
+ tcg_out_insn(s, 3305, LDR, offset, TCG_REG_TMP);
+ }
+ tcg_out_insn(s, 3207, BR, TCG_REG_TMP);
+- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, a0);
+ break;
+
+ case INDEX_op_goto_ptr:
+diff -ru qemu-2.12.0/tcg/arm/tcg-target.inc.c
qemu-2.12.0-modified/tcg/arm/tcg-target.inc.c
+--- qemu-2.12.0/tcg/arm/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/arm/tcg-target.inc.c 2018-06-15
15:47:20.557969818 +0200
+@@ -1822,7 +1822,7 @@
+ tcg_out_movi32(s, COND_AL, base, ptr - dil);
+ }
+ tcg_out_ld32_12(s, COND_AL, TCG_REG_PC, base, dil);
+- s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, args[0]);
+ }
+ break;
+ case INDEX_op_goto_ptr:
+diff -ru qemu-2.12.0/tcg/i386/tcg-target.inc.c
qemu-2.12.0-modified/tcg/i386/tcg-target.inc.c
+--- qemu-2.12.0/tcg/i386/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/i386/tcg-target.inc.c 2018-06-15
15:47:20.558969815 +0200
+@@ -2245,7 +2245,7 @@
+ tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, -1,
+ (intptr_t)(s->tb_jmp_target_addr + a0));
+ }
+- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, a0);
+ break;
+ case INDEX_op_goto_ptr:
+ /* jmp to the given host address (could be epilogue) */
+diff -ru qemu-2.12.0/tcg/mips/tcg-target.inc.c
qemu-2.12.0-modified/tcg/mips/tcg-target.inc.c
+--- qemu-2.12.0/tcg/mips/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/mips/tcg-target.inc.c 2018-06-15
15:47:20.558969815 +0200
+@@ -1744,7 +1744,7 @@
+ tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
+ }
+ tcg_out_nop(s);
+- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, a0);
+ break;
+ case INDEX_op_goto_ptr:
+ /* jmp to the given host address (could be epilogue) */
+diff -ru qemu-2.12.0/tcg/ppc/tcg-target.inc.c
qemu-2.12.0-modified/tcg/ppc/tcg-target.inc.c
+--- qemu-2.12.0/tcg/ppc/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/ppc/tcg-target.inc.c 2018-06-15
15:47:20.558969815 +0200
+@@ -2025,10 +2025,10 @@
+ }
+ tcg_out32(s, MTSPR | RS(TCG_REG_TB) | CTR);
+ tcg_out32(s, BCCTR | BO_ALWAYS);
+- s->tb_jmp_reset_offset[args[0]] = c = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, args[0]);
+ if (USE_REG_TB) {
+ /* For the unlinked case, need to reset TCG_REG_TB. */
+- c = -c;
++ c = -tcg_current_code_size(s);
+ assert(c == (int16_t)c);
+ tcg_out32(s, ADDI | TAI(TCG_REG_TB, TCG_REG_TB, c));
+ }
+diff -ru qemu-2.12.0/tcg/s390/tcg-target.inc.c
qemu-2.12.0-modified/tcg/s390/tcg-target.inc.c
+--- qemu-2.12.0/tcg/s390/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/s390/tcg-target.inc.c 2018-06-15
15:47:20.558969815 +0200
+@@ -1783,7 +1783,7 @@
+ /* and go there */
+ tcg_out_insn(s, RR, BCR, S390_CC_ALWAYS, TCG_REG_TB);
+ }
+- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, a0);
+
+ /* For the unlinked path of goto_tb, we need to reset
+ TCG_REG_TB to the beginning of this TB. */
+diff -ru qemu-2.12.0/tcg/sparc/tcg-target.inc.c
qemu-2.12.0-modified/tcg/sparc/tcg-target.inc.c
+--- qemu-2.12.0/tcg/sparc/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/sparc/tcg-target.inc.c 2018-06-15
15:47:20.559969811 +0200
+@@ -1388,12 +1388,12 @@
+ tcg_out_arithi(s, TCG_REG_G0, TCG_REG_TB, 0, JMPL);
+ tcg_out_nop(s);
+ }
+- s->tb_jmp_reset_offset[a0] = c = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, a0);
+
+ /* For the unlinked path of goto_tb, we need to reset
+ TCG_REG_TB to the beginning of this TB. */
+ if (USE_REG_TB) {
+- c = -c;
++ c = -tcg_current_code_size(s);
+ if (check_fit_i32(c, 13)) {
+ tcg_out_arithi(s, TCG_REG_TB, TCG_REG_TB, c, ARITH_ADD);
+ } else {
+diff -ru qemu-2.12.0/tcg/tcg.c qemu-2.12.0-modified/tcg/tcg.c
+--- qemu-2.12.0/tcg/tcg.c 2018-04-24 18:30:47.000000000 +0200
++++ qemu-2.12.0-modified/tcg/tcg.c 2018-06-15 16:02:55.042712421 +0200
+@@ -293,6 +293,14 @@
+ return l;
+ }
+
++static void set_jmp_reset_offset(TCGContext *s, int which)
++{
++ size_t off = tcg_current_code_size(s);
++ s->tb_jmp_reset_offset[which] = off;
++ /* Make sure that we didn't overflow the stored offset. */
++ assert(s->tb_jmp_reset_offset[which] == off);
++}
++
+ #include "tcg-target.inc.c"
+
+ static void tcg_region_bounds(size_t curr_region, void **pstart, void **pend)
+@@ -866,6 +874,7 @@
+ /* No temps have been previously allocated for size or locality. */
+ memset(s->free_temps, 0, sizeof(s->free_temps));
+
++ s->nb_ops = 0;
+ s->nb_labels = 0;
+ s->current_frame_offset = s->frame_start;
+
+@@ -1983,6 +1992,7 @@
+ {
+ QTAILQ_REMOVE(&s->ops, op, link);
+ QTAILQ_INSERT_TAIL(&s->free_ops, op, link);
++ s->nb_ops--;
+
+ #ifdef CONFIG_PROFILER
+ atomic_set(&s->prof.del_op_count, s->prof.del_op_count + 1);
+@@ -2002,6 +2012,7 @@
+ }
+ memset(op, 0, offsetof(TCGOp, link));
+ op->opc = opc;
++ s->nb_ops++;
+
+ return op;
+ }
+@@ -3351,7 +3362,10 @@
+ break;
+ case INDEX_op_insn_start:
+ if (num_insns >= 0) {
+- s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
++ size_t off = tcg_current_code_size(s);
++ s->gen_insn_end_off[num_insns] = off;
++ /* Assert that we do not overflow our stored offset. */
++ assert(s->gen_insn_end_off[num_insns] == off);
+ }
+ num_insns++;
+ for (i = 0; i < TARGET_INSN_START_WORDS; ++i) {
+Only in qemu-2.12.0-modified/tcg: tcg.c.orig
+diff -ru qemu-2.12.0/tcg/tcg.h qemu-2.12.0-modified/tcg/tcg.h
+--- qemu-2.12.0/tcg/tcg.h 2018-06-15 16:03:35.881570182 +0200
++++ qemu-2.12.0-modified/tcg/tcg.h 2018-06-15 16:04:06.514463493 +0200
+@@ -655,6 +655,7 @@
+ int nb_globals;
+ int nb_temps;
+ int nb_indirects;
++ int nb_ops;
+
+ /* goto_tb support */
+ tcg_insn_unit *code_buf;
+@@ -844,7 +845,7 @@
+ /* Test for whether to terminate the TB for using too many opcodes. */
+ static inline bool tcg_op_buf_full(void)
+ {
+- return false;
++ return tcg_ctx->nb_ops >= 4000;
+ }
+
+ /* pool based memory allocation */
+Only in qemu-2.12.0-modified/tcg: tcg.h.orig
+Only in qemu-2.12.0-modified/tcg: tcg.h.rej
+diff -ru qemu-2.12.0/tcg/tci/tcg-target.inc.c
qemu-2.12.0-modified/tcg/tci/tcg-target.inc.c
+--- qemu-2.12.0/tcg/tci/tcg-target.inc.c 2018-04-24 18:30:47.000000000
+0200
++++ qemu-2.12.0-modified/tcg/tci/tcg-target.inc.c 2018-06-15
15:47:20.559969811 +0200
+@@ -574,7 +574,7 @@
+ /* Indirect jump method. */
+ TODO();
+ }
+- s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s);
++ set_jmp_reset_offset(s, args[0]);
+ break;
+ case INDEX_op_br:
+ tci_out_label(s, arg_label(args[0]));
diff --git a/app-emulation/qemu/qemu-2.12.0-r2.ebuild
b/app-emulation/qemu/qemu-2.12.0-r3.ebuild
similarity index 99%
rename from app-emulation/qemu/qemu-2.12.0-r2.ebuild
rename to app-emulation/qemu/qemu-2.12.0-r3.ebuild
index 0aa4e9242b2..8a89d0ca6da 100644
--- a/app-emulation/qemu/qemu-2.12.0-r2.ebuild
+++ b/app-emulation/qemu/qemu-2.12.0-r3.ebuild
@@ -216,6 +216,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-2.5.0-cflags.patch
"${FILESDIR}"/${PN}-2.5.0-sysmacros.patch
"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
+ "${FILESDIR}"/${P}-tcg-instruction-overflow.patch # Will be fixed in
2.12.1
"${WORKDIR}"/patches
)
