[Qemu-devel] [RFC 0/3] target/m68k: fix TCGv array overflow

[Laurent Vivier]

Since commit 15fa08f845 ("tcg: Dynamically allocate TCGOps")
we have no limit to fill the TCGOps cache and we can fill
the entire TCG variables array and overflow it.

It seems to happen only with m68k, because m68k translator
doesn't free some TCGv at end of instruction translation
because the variable can be either temporary one or an
allocated one,

I try to fix this by introducing a new TCG function
to try to free a TCGv if it is a temporary one and
do nothing otherwise (patches 1 and 2)

The last patch is here to avoid the error and
stop the translation before the buffer overflows
(but I guess we should not need this with correctly
written translation functions...)

Laurent Vivier (3):
  tcg: introduce tcg_temp_try_free()
  target/m68k: use tcg_temp_try_free()
  m68k: Test if we overflow the temp variable array

 target/m68k/translate.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++-
 tcg/tcg-op.h            |  2 ++
 tcg/tcg.c               | 28 +++++++++++++++------
 tcg/tcg.h               |  9 +++++++
 4 files changed, 98 insertions(+), 8 deletions(-)

-- 
2.14.3