Currently the dc_zva helper function uses a variable length
array. In fact we know (as the comment above remarks) that
the length of this array is bounded because the architecture
limits the block size and QEMU limits the target page size.
Use a fixed array size and assert that we don't run off it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
A small move in the direction of "avoid using variable length
arrays in QEMU"...

 target/arm/helper.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index a36f4b3d699..1b6225cb598 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1,4 +1,5 @@
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "target/arm/idau.h"
 #include "trace.h"
 #include "cpu.h"
@@ -12412,11 +12413,13 @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
          * same QEMU executable.
          */
         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
-        void *hostaddr[maxidx];
+        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
         int try, i;
         unsigned mmu_idx = cpu_mmu_index(env, false);
         TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 
+        assert(maxidx <= sizeof(hostaddr));
+
         for (try = 0; try < 2; try++) {
 
             for (i = 0; i < maxidx; i++) {
-- 
2.20.1

Le jeu. 28 mars 2019 15:30, Peter Maydell <peter.maydell@linaro.org> a
écrit :

> Currently the dc_zva helper function uses a variable length
> array. In fact we know (as the comment above remarks) that
> the length of this array is bounded because the architecture
> limits the block size and QEMU limits the target page size.
> Use a fixed array size and assert that we don't run off it.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> A small move in the direction of "avoid using variable length
> arrays in QEMU"...
>
>  target/arm/helper.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index a36f4b3d699..1b6225cb598 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1,4 +1,5 @@
>  #include "qemu/osdep.h"
> +#include "qemu/units.h"
>  #include "target/arm/idau.h"
>  #include "trace.h"
>  #include "cpu.h"
> @@ -12412,11 +12413,13 @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t
> vaddr_in)
>           * same QEMU executable.
>           */
>          int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
> -        void *hostaddr[maxidx];
> +        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
>

Or g_new()... For 2K nowadays that is fine.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

         int try, i;
>          unsigned mmu_idx = cpu_mmu_index(env, false);
>          TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
>
> +        assert(maxidx <= sizeof(hostaddr));
> +
>          for (try = 0; try < 2; try++) {
>
>              for (i = 0; i < maxidx; i++) {
> --
> 2.20.1
>
>
>

On 3/28/19 7:30 AM, Peter Maydell wrote:
> -        void *hostaddr[maxidx];
> +        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];

A very fancy way of writing "2".

>          int try, i;
>          unsigned mmu_idx = cpu_mmu_index(env, false);
>          TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
>  
> +        assert(maxidx <= sizeof(hostaddr));

ARRAY_SIZE(hostaddr).


r~

On Thu, 28 Mar 2019 at 19:14, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 3/28/19 7:30 AM, Peter Maydell wrote:
> > -        void *hostaddr[maxidx];
> > +        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
>
> A very fancy way of writing "2".

Yes, but I thought this made the relationship between the constant
size and what maxidx a little clearer.
>
> >          int try, i;
> >          unsigned mmu_idx = cpu_mmu_index(env, false);
> >          TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
> >
> > +        assert(maxidx <= sizeof(hostaddr));
>
> ARRAY_SIZE(hostaddr).

Oops, yes.

thanks
-- PMM