mirrors/unicorn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix possible wrong conditional branch in generated host code by fixing

Browse Source 
the tcg_liveness_analysis().
Refer to https://github.com/unicorn-engine/unicorn/issues/287 for further info.
This commit is contained in:
JC Yang 2015-12-21 18:01:01 +08:00
parent 60f6fc425a
commit 8ef018a2cb
12 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
qemu/aarch64.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_aarch64
#define tcg_invert_cond tcg_invert_cond_aarch64
#define tcg_la_bb_end tcg_la_bb_end_aarch64
#define tcg_la_br_end tcg_la_br_end_aarch64
#define tcg_la_func_end tcg_la_func_end_aarch64
#define tcg_liveness_analysis tcg_liveness_analysis_aarch64
#define tcg_malloc tcg_malloc_aarch64

1
qemu/arm.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_arm
#define tcg_invert_cond tcg_invert_cond_arm
#define tcg_la_bb_end tcg_la_bb_end_arm
#define tcg_la_br_end tcg_la_br_end_arm
#define tcg_la_func_end tcg_la_func_end_arm
#define tcg_liveness_analysis tcg_liveness_analysis_arm
#define tcg_malloc tcg_malloc_arm

1
qemu/header_gen.py
View File

@ -2951,6 +2951,7 @@ symbols = (
'tcg_init',
'tcg_invert_cond',
'tcg_la_bb_end',
'tcg_la_br_end',
'tcg_la_func_end',
'tcg_liveness_analysis',
'tcg_malloc',

1
qemu/m68k.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_m68k
#define tcg_invert_cond tcg_invert_cond_m68k
#define tcg_la_bb_end tcg_la_bb_end_m68k
#define tcg_la_br_end tcg_la_br_end_m68k
#define tcg_la_func_end tcg_la_func_end_m68k
#define tcg_liveness_analysis tcg_liveness_analysis_m68k
#define tcg_malloc tcg_malloc_m68k

1
qemu/mips.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_mips
#define tcg_invert_cond tcg_invert_cond_mips
#define tcg_la_bb_end tcg_la_bb_end_mips
#define tcg_la_br_end tcg_la_br_end_mips
#define tcg_la_func_end tcg_la_func_end_mips
#define tcg_liveness_analysis tcg_liveness_analysis_mips
#define tcg_malloc tcg_malloc_mips

1
qemu/mips64.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_mips64
#define tcg_invert_cond tcg_invert_cond_mips64
#define tcg_la_bb_end tcg_la_bb_end_mips64
#define tcg_la_br_end tcg_la_br_end_mips64
#define tcg_la_func_end tcg_la_func_end_mips64
#define tcg_liveness_analysis tcg_liveness_analysis_mips64
#define tcg_malloc tcg_malloc_mips64

1
qemu/mips64el.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_mips64el
#define tcg_invert_cond tcg_invert_cond_mips64el
#define tcg_la_bb_end tcg_la_bb_end_mips64el
#define tcg_la_br_end tcg_la_br_end_mips64el
#define tcg_la_func_end tcg_la_func_end_mips64el
#define tcg_liveness_analysis tcg_liveness_analysis_mips64el
#define tcg_malloc tcg_malloc_mips64el

1
qemu/mipsel.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_mipsel
#define tcg_invert_cond tcg_invert_cond_mipsel
#define tcg_la_bb_end tcg_la_bb_end_mipsel
#define tcg_la_br_end tcg_la_br_end_mipsel
#define tcg_la_func_end tcg_la_func_end_mipsel
#define tcg_liveness_analysis tcg_liveness_analysis_mipsel
#define tcg_malloc tcg_malloc_mipsel

1
qemu/sparc.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_sparc
#define tcg_invert_cond tcg_invert_cond_sparc
#define tcg_la_bb_end tcg_la_bb_end_sparc
#define tcg_la_br_end tcg_la_br_end_sparc
#define tcg_la_func_end tcg_la_func_end_sparc
#define tcg_liveness_analysis tcg_liveness_analysis_sparc
#define tcg_malloc tcg_malloc_sparc

1
qemu/sparc64.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_sparc64
#define tcg_invert_cond tcg_invert_cond_sparc64
#define tcg_la_bb_end tcg_la_bb_end_sparc64
#define tcg_la_br_end tcg_la_br_end_sparc64
#define tcg_la_func_end tcg_la_func_end_sparc64
#define tcg_liveness_analysis tcg_liveness_analysis_sparc64
#define tcg_malloc tcg_malloc_sparc64

24
qemu/tcg/tcg.c
View File

@ -1445,6 +1445,18 @@ static inline void tcg_la_bb_end(TCGContext *s, uint8_t *dead_temps,
}
}
/*
Unicorn: for brcond, we should refresh liveness states for TCG globals
*/
static inline void tcg_la_br_end(TCGContext *s, uint8_t *mem_temps)
{
int i;
memset(mem_temps, 1, s->nb_globals);
for(i = s->nb_globals; i < s->nb_temps; i++) {
mem_temps[i] = s->temps[i].temp_local;
}
}
/* Liveness analysis : update the opc_dead_args array to tell if a
given input arguments is dead. Instructions updating dead
temporaries are removed. */
@ -1682,12 +1694,20 @@ static void tcg_liveness_analysis(TCGContext *s)
}
/* if end of basic block, update */
if (def->flags & TCG_OPF_BB_END && op != INDEX_op_brcond_i32) {
if (def->flags & TCG_OPF_BB_END) {
// Unicorn: do not optimize dead temps on brcond,
// this causes problem because check_exit_request() inserts
// brcond instruction in the middle of the TB,
// which incorrectly flags end-of-block
tcg_la_bb_end(s, dead_temps, mem_temps);
if (op != INDEX_op_brcond_i32)
tcg_la_bb_end(s, dead_temps, mem_temps);
// Unicorn: we do not touch dead temps for brcond,
// but we should refresh TCG globals In-Memory states,
// otherwise, important CPU states(especially conditional flags) might be forgotten,
// result in wrongly generated host code that run into wrong branch.
// Refer to https://github.com/unicorn-engine/unicorn/issues/287 for further information
else
tcg_la_br_end(s, mem_temps);
} else if (def->flags & TCG_OPF_SIDE_EFFECTS) {
/* globals should be synced to memory */
memset(mem_temps, 1, s->nb_globals);

1
qemu/x86_64.h
View File

@ -2945,6 +2945,7 @@
#define tcg_init tcg_init_x86_64
#define tcg_invert_cond tcg_invert_cond_x86_64
#define tcg_la_bb_end tcg_la_bb_end_x86_64
#define tcg_la_br_end tcg_la_br_end_x86_64
#define tcg_la_func_end tcg_la_func_end_x86_64
#define tcg_liveness_analysis tcg_liveness_analysis_x86_64
#define tcg_malloc tcg_malloc_x86_64