From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A1C03138334 for ; Fri, 15 Jun 2018 14:10:23 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 310F8E08FC; Fri, 15 Jun 2018 14:10:21 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D8096E08FC for ; Fri, 15 Jun 2018 14:10:20 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 83BAD335C76 for ; Fri, 15 Jun 2018 14:10:16 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 330A02CC for ; Fri, 15 Jun 2018 14:10:08 +0000 (UTC) From: "Jason Donenfeld" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Donenfeld" Message-ID: <1529071800.c61676a2378adeebe401e204510cecd9077c4358.zx2c4@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-emulation/qemu/files/, app-emulation/qemu/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch app-emulation/qemu/qemu-2.12.0-r2.ebuild app-emulation/qemu/qemu-2.12.0-r3.ebuild X-VCS-Directories: app-emulation/qemu/files/ app-emulation/qemu/ X-VCS-Committer: zx2c4 X-VCS-Committer-Name: Jason Donenfeld X-VCS-Revision: c61676a2378adeebe401e204510cecd9077c4358 X-VCS-Branch: master Date: Fri, 15 Jun 2018 14:10:08 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 57052d02-20a7-4510-8f40-9ce53a88f304 X-Archives-Hash: 5ffb91db041031639a5f484fd05194c4 commit: c61676a2378adeebe401e204510cecd9077c4358 Author: Jason A. Donenfeld gentoo org> AuthorDate: Fri Jun 15 14:09:33 2018 +0000 Commit: Jason Donenfeld gentoo org> CommitDate: Fri Jun 15 14:10:00 2018 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c61676a2 app-emulation/qemu: fix major TCG crash This is a custom backport of a patch being prepared for 2.12.1. Package-Manager: Portage-2.3.40, Repoman-2.3.9 .../qemu-2.12.0-tcg-instruction-overflow.patch | 183 +++++++++++++++++++++ ...qemu-2.12.0-r2.ebuild => qemu-2.12.0-r3.ebuild} | 1 + 2 files changed, 184 insertions(+) diff --git a/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch b/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch new file mode 100644 index 00000000000..24df138a777 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.12.0-tcg-instruction-overflow.patch @@ -0,0 +1,183 @@ +diff -ru qemu-2.12.0/tcg/aarch64/tcg-target.inc.c qemu-2.12.0-modified/tcg/aarch64/tcg-target.inc.c +--- qemu-2.12.0/tcg/aarch64/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/aarch64/tcg-target.inc.c 2018-06-15 15:47:20.557969818 +0200 +@@ -1733,7 +1733,7 @@ + tcg_out_insn(s, 3305, LDR, offset, TCG_REG_TMP); + } + tcg_out_insn(s, 3207, BR, TCG_REG_TMP); +- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, a0); + break; + + case INDEX_op_goto_ptr: +diff -ru qemu-2.12.0/tcg/arm/tcg-target.inc.c qemu-2.12.0-modified/tcg/arm/tcg-target.inc.c +--- qemu-2.12.0/tcg/arm/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/arm/tcg-target.inc.c 2018-06-15 15:47:20.557969818 +0200 +@@ -1822,7 +1822,7 @@ + tcg_out_movi32(s, COND_AL, base, ptr - dil); + } + tcg_out_ld32_12(s, COND_AL, TCG_REG_PC, base, dil); +- s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, args[0]); + } + break; + case INDEX_op_goto_ptr: +diff -ru qemu-2.12.0/tcg/i386/tcg-target.inc.c qemu-2.12.0-modified/tcg/i386/tcg-target.inc.c +--- qemu-2.12.0/tcg/i386/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/i386/tcg-target.inc.c 2018-06-15 15:47:20.558969815 +0200 +@@ -2245,7 +2245,7 @@ + tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, -1, + (intptr_t)(s->tb_jmp_target_addr + a0)); + } +- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, a0); + break; + case INDEX_op_goto_ptr: + /* jmp to the given host address (could be epilogue) */ +diff -ru qemu-2.12.0/tcg/mips/tcg-target.inc.c qemu-2.12.0-modified/tcg/mips/tcg-target.inc.c +--- qemu-2.12.0/tcg/mips/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/mips/tcg-target.inc.c 2018-06-15 15:47:20.558969815 +0200 +@@ -1744,7 +1744,7 @@ + tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0); + } + tcg_out_nop(s); +- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, a0); + break; + case INDEX_op_goto_ptr: + /* jmp to the given host address (could be epilogue) */ +diff -ru qemu-2.12.0/tcg/ppc/tcg-target.inc.c qemu-2.12.0-modified/tcg/ppc/tcg-target.inc.c +--- qemu-2.12.0/tcg/ppc/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/ppc/tcg-target.inc.c 2018-06-15 15:47:20.558969815 +0200 +@@ -2025,10 +2025,10 @@ + } + tcg_out32(s, MTSPR | RS(TCG_REG_TB) | CTR); + tcg_out32(s, BCCTR | BO_ALWAYS); +- s->tb_jmp_reset_offset[args[0]] = c = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, args[0]); + if (USE_REG_TB) { + /* For the unlinked case, need to reset TCG_REG_TB. */ +- c = -c; ++ c = -tcg_current_code_size(s); + assert(c == (int16_t)c); + tcg_out32(s, ADDI | TAI(TCG_REG_TB, TCG_REG_TB, c)); + } +diff -ru qemu-2.12.0/tcg/s390/tcg-target.inc.c qemu-2.12.0-modified/tcg/s390/tcg-target.inc.c +--- qemu-2.12.0/tcg/s390/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/s390/tcg-target.inc.c 2018-06-15 15:47:20.558969815 +0200 +@@ -1783,7 +1783,7 @@ + /* and go there */ + tcg_out_insn(s, RR, BCR, S390_CC_ALWAYS, TCG_REG_TB); + } +- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, a0); + + /* For the unlinked path of goto_tb, we need to reset + TCG_REG_TB to the beginning of this TB. */ +diff -ru qemu-2.12.0/tcg/sparc/tcg-target.inc.c qemu-2.12.0-modified/tcg/sparc/tcg-target.inc.c +--- qemu-2.12.0/tcg/sparc/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/sparc/tcg-target.inc.c 2018-06-15 15:47:20.559969811 +0200 +@@ -1388,12 +1388,12 @@ + tcg_out_arithi(s, TCG_REG_G0, TCG_REG_TB, 0, JMPL); + tcg_out_nop(s); + } +- s->tb_jmp_reset_offset[a0] = c = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, a0); + + /* For the unlinked path of goto_tb, we need to reset + TCG_REG_TB to the beginning of this TB. */ + if (USE_REG_TB) { +- c = -c; ++ c = -tcg_current_code_size(s); + if (check_fit_i32(c, 13)) { + tcg_out_arithi(s, TCG_REG_TB, TCG_REG_TB, c, ARITH_ADD); + } else { +diff -ru qemu-2.12.0/tcg/tcg.c qemu-2.12.0-modified/tcg/tcg.c +--- qemu-2.12.0/tcg/tcg.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/tcg.c 2018-06-15 16:02:55.042712421 +0200 +@@ -293,6 +293,14 @@ + return l; + } + ++static void set_jmp_reset_offset(TCGContext *s, int which) ++{ ++ size_t off = tcg_current_code_size(s); ++ s->tb_jmp_reset_offset[which] = off; ++ /* Make sure that we didn't overflow the stored offset. */ ++ assert(s->tb_jmp_reset_offset[which] == off); ++} ++ + #include "tcg-target.inc.c" + + static void tcg_region_bounds(size_t curr_region, void **pstart, void **pend) +@@ -866,6 +874,7 @@ + /* No temps have been previously allocated for size or locality. */ + memset(s->free_temps, 0, sizeof(s->free_temps)); + ++ s->nb_ops = 0; + s->nb_labels = 0; + s->current_frame_offset = s->frame_start; + +@@ -1983,6 +1992,7 @@ + { + QTAILQ_REMOVE(&s->ops, op, link); + QTAILQ_INSERT_TAIL(&s->free_ops, op, link); ++ s->nb_ops--; + + #ifdef CONFIG_PROFILER + atomic_set(&s->prof.del_op_count, s->prof.del_op_count + 1); +@@ -2002,6 +2012,7 @@ + } + memset(op, 0, offsetof(TCGOp, link)); + op->opc = opc; ++ s->nb_ops++; + + return op; + } +@@ -3351,7 +3362,10 @@ + break; + case INDEX_op_insn_start: + if (num_insns >= 0) { +- s->gen_insn_end_off[num_insns] = tcg_current_code_size(s); ++ size_t off = tcg_current_code_size(s); ++ s->gen_insn_end_off[num_insns] = off; ++ /* Assert that we do not overflow our stored offset. */ ++ assert(s->gen_insn_end_off[num_insns] == off); + } + num_insns++; + for (i = 0; i < TARGET_INSN_START_WORDS; ++i) { +Only in qemu-2.12.0-modified/tcg: tcg.c.orig +diff -ru qemu-2.12.0/tcg/tcg.h qemu-2.12.0-modified/tcg/tcg.h +--- qemu-2.12.0/tcg/tcg.h 2018-06-15 16:03:35.881570182 +0200 ++++ qemu-2.12.0-modified/tcg/tcg.h 2018-06-15 16:04:06.514463493 +0200 +@@ -655,6 +655,7 @@ + int nb_globals; + int nb_temps; + int nb_indirects; ++ int nb_ops; + + /* goto_tb support */ + tcg_insn_unit *code_buf; +@@ -844,7 +845,7 @@ + /* Test for whether to terminate the TB for using too many opcodes. */ + static inline bool tcg_op_buf_full(void) + { +- return false; ++ return tcg_ctx->nb_ops >= 4000; + } + + /* pool based memory allocation */ +Only in qemu-2.12.0-modified/tcg: tcg.h.orig +Only in qemu-2.12.0-modified/tcg: tcg.h.rej +diff -ru qemu-2.12.0/tcg/tci/tcg-target.inc.c qemu-2.12.0-modified/tcg/tci/tcg-target.inc.c +--- qemu-2.12.0/tcg/tci/tcg-target.inc.c 2018-04-24 18:30:47.000000000 +0200 ++++ qemu-2.12.0-modified/tcg/tci/tcg-target.inc.c 2018-06-15 15:47:20.559969811 +0200 +@@ -574,7 +574,7 @@ + /* Indirect jump method. */ + TODO(); + } +- s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s); ++ set_jmp_reset_offset(s, args[0]); + break; + case INDEX_op_br: + tci_out_label(s, arg_label(args[0])); diff --git a/app-emulation/qemu/qemu-2.12.0-r2.ebuild b/app-emulation/qemu/qemu-2.12.0-r3.ebuild similarity index 99% rename from app-emulation/qemu/qemu-2.12.0-r2.ebuild rename to app-emulation/qemu/qemu-2.12.0-r3.ebuild index 0aa4e9242b2..8a89d0ca6da 100644 --- a/app-emulation/qemu/qemu-2.12.0-r2.ebuild +++ b/app-emulation/qemu/qemu-2.12.0-r3.ebuild @@ -216,6 +216,7 @@ PATCHES=( "${FILESDIR}"/${PN}-2.5.0-cflags.patch "${FILESDIR}"/${PN}-2.5.0-sysmacros.patch "${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch + "${FILESDIR}"/${P}-tcg-instruction-overflow.patch # Will be fixed in 2.12.1 "${WORKDIR}"/patches )