aboutsummaryrefslogtreecommitdiff
path: root/tcg/aarch64
diff options
context:
space:
mode:
authorRichard Henderson <richard.henderson@linaro.org>2018-06-14 19:57:03 -1000
committerRichard Henderson <richard.henderson@linaro.org>2018-06-15 09:39:53 -1000
commit9f754620651d3432114f4bb89c7f12cbea814b3e (patch)
tree7450e7708caa0ef187fc4fb66d62695e33a2c82b /tcg/aarch64
parent0ac20318ce16f4de288969b2007ef5a654176058 (diff)
downloadqemu-9f754620651d3432114f4bb89c7f12cbea814b3e.zip
qemu-9f754620651d3432114f4bb89c7f12cbea814b3e.tar.gz
qemu-9f754620651d3432114f4bb89c7f12cbea814b3e.tar.bz2
tcg: Reduce max TB opcode count
Also, assert that we don't overflow any of two different offsets into the TB. Both unwind and goto_tb both record a uint16_t for later use. This fixes an arm-softmmu test case utilizing NEON in which there is a TB generated that runs to 7800 opcodes, and compiles to 96k on an x86_64 host. This overflows the 16-bit offset in which we record the goto_tb reset offset. Because of that overflow, we install a jump destination that goes to neverland. Boom. With this reduced op count, the same TB compiles to about 48k for aarch64, ppc64le, and x86_64 hosts, and neither assertion fires. Cc: qemu-stable@nongnu.org Reported-by: "Jason A. Donenfeld" <Jason@zx2c4.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'tcg/aarch64')
-rw-r--r--tcg/aarch64/tcg-target.inc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
index be31920..4562d36 100644
--- a/tcg/aarch64/tcg-target.inc.c
+++ b/tcg/aarch64/tcg-target.inc.c
@@ -1733,7 +1733,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
tcg_out_insn(s, 3305, LDR, offset, TCG_REG_TMP);
}
tcg_out_insn(s, 3207, BR, TCG_REG_TMP);
- s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s);
+ set_jmp_reset_offset(s, a0);
break;
case INDEX_op_goto_ptr: