Commit 5c53bb81 authored by Peter Maydell's avatar Peter Maydell Committed by Richard Henderson
Browse files

tcg: Avoid undefined behaviour patching code at unaligned addresses 



To avoid C undefined behaviour when patching generated code,
provide wrappers tcg_patch8/16/32/64 which use the usual memcpy
trick, and use them in the i386 backend.

Reviewed-by: default avatarAlex Bennée <alex.bennee@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarRichard Henderson <rth@twiddle.net>
parent 4387345a

tcg/i386/tcg-target.c

+6 −6
Original line number Diff line number Diff line
@@ -151,14 +151,14 @@ static void patch_reloc(uint8_t *code_ptr, int type, 
        if (value != (int32_t)value) {

            tcg_abort();

        }

        *(uint32_t *)code_ptr = value;

        tcg_patch32(code_ptr, value);

        break;

    case R_386_PC8:

        value -= (uintptr_t)code_ptr;

        if (value != (int8_t)value) {

            tcg_abort();

        }

        *(uint8_t *)code_ptr = value;

        tcg_patch8(code_ptr, value);

        break;

    default:

        tcg_abort();
@@ -1276,9 +1276,9 @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l) 
    uint8_t **label_ptr = &l->label_ptr[0];



    /* resolve label address */

    *(uint32_t *)label_ptr[0] = (uint32_t)(s->code_ptr - label_ptr[0] - 4);

    tcg_patch32(label_ptr[0], s->code_ptr - label_ptr[0] - 4);

    if (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) {

        *(uint32_t *)label_ptr[1] = (uint32_t)(s->code_ptr - label_ptr[1] - 4);

        tcg_patch32(label_ptr[1], s->code_ptr - label_ptr[1] - 4);

    }



    if (TCG_TARGET_REG_BITS == 32) {
@@ -1360,9 +1360,9 @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l) 
    TCGReg retaddr;



    /* resolve label address */

    *(uint32_t *)label_ptr[0] = (uint32_t)(s->code_ptr - label_ptr[0] - 4);

    tcg_patch32(label_ptr[0], s->code_ptr - label_ptr[0] - 4);

    if (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) {

        *(uint32_t *)label_ptr[1] = (uint32_t)(s->code_ptr - label_ptr[1] - 4);

        tcg_patch32(label_ptr[1], s->code_ptr - label_ptr[1] - 4);

    }



    if (TCG_TARGET_REG_BITS == 32) {

tcg/tcg.c

+20 −0
Original line number Diff line number Diff line
@@ -122,6 +122,11 @@ static inline void tcg_out8(TCGContext *s, uint8_t v) 
    *s->code_ptr++ = v;

}



static inline void tcg_patch8(uint8_t *p, uint8_t v)

{

    memcpy(p, &v, sizeof(v));

}



static inline void tcg_out16(TCGContext *s, uint16_t v)

{

    uint8_t *p = s->code_ptr;
@@ -129,6 +134,11 @@ static inline void tcg_out16(TCGContext *s, uint16_t v) 
    s->code_ptr = p + 2;

}



static inline void tcg_patch16(uint8_t *p, uint16_t v)

{

    memcpy(p, &v, sizeof(v));

}



static inline void tcg_out32(TCGContext *s, uint32_t v)

{

    uint8_t *p = s->code_ptr;
@@ -136,6 +146,11 @@ static inline void tcg_out32(TCGContext *s, uint32_t v) 
    s->code_ptr = p + 4;

}



static inline void tcg_patch32(uint8_t *p, uint32_t v)

{

    memcpy(p, &v, sizeof(v));

}



static inline void tcg_out64(TCGContext *s, uint64_t v)

{

    uint8_t *p = s->code_ptr;
@@ -143,6 +158,11 @@ static inline void tcg_out64(TCGContext *s, uint64_t v) 
    s->code_ptr = p + 8;

}



static inline void tcg_patch64(uint8_t *p, uint64_t v)

{

    memcpy(p, &v, sizeof(v));

}



/* label relocation processing */



static void tcg_out_reloc(TCGContext *s, uint8_t *code_ptr, int type,