arm: Fixes based on UBSan and static analysis

Another churn to clean up undefined behaviour, mostly ARM, but some
parts also touching the generic part of the code base.

Most of the fixes are simply ensuring that proper intialisation. One
of the more subtle changes is the return type of the sign-extension,
which is changed to uint64_t. This is to avoid shifting negative
values (undefined behaviour) in the ISA code.

19 files changed, 57 insertions, 33 deletions

diff --git a/src/arch/arm/faults.hh b/src/arch/arm/faults.hh
index 4980c12e1..ef87ee145 100644
--- a/src/arch/arm/faults.hh
+++ b/src/arch/arm/faults.hh
@@ -172,7 +172,8 @@ class ArmFault : public FaultBase
     };
 
     ArmFault(ExtMachInst _machInst = 0, uint32_t _iss = 0) :
-        machInst(_machInst), issRaw(_iss), from64(false), to64(false) {}
+        machInst(_machInst), issRaw(_iss), from64(false), to64(false),
+        fromEL(EL0), toEL(EL0), fromMode(MODE_UNDEFINED) {}
 
     // Returns the actual syndrome register to use based on the target
     // exception level
@@ -395,9 +396,11 @@ class AbortFault : public ArmFaultVals<T>
     ArmFault::TranMethod tranMethod;
 
   public:
-    AbortFault(Addr _faultAddr, bool _write, TlbEntry::DomainType _domain, uint8_t _source,
-               bool _stage2, ArmFault::TranMethod _tranMethod = ArmFault::UnknownTran) :
-        faultAddr(_faultAddr), write(_write), domain(_domain), source(_source),
+    AbortFault(Addr _faultAddr, bool _write, TlbEntry::DomainType _domain,
+               uint8_t _source, bool _stage2,
+               ArmFault::TranMethod _tranMethod = ArmFault::UnknownTran) :
+        faultAddr(_faultAddr), OVAddr(0), write(_write),
+        domain(_domain), source(_source), srcEncoded(0),
         stage2(_stage2), s1ptw(false), tranMethod(_tranMethod)
     {}
 
diff --git a/src/arch/arm/insts/macromem.cc b/src/arch/arm/insts/macromem.cc
index 1ea968328..3158026db 100644
--- a/src/arch/arm/insts/macromem.cc
+++ b/src/arch/arm/insts/macromem.cc
@@ -1281,7 +1281,10 @@ VldSingleOp64::VldSingleOp64(const char *mnem, ExtMachInst machInst,
                              RegIndex rm, uint8_t eSize, uint8_t dataSize,
                              uint8_t numStructElems, uint8_t index, bool wb,
                              bool replicate) :
-    PredMacroOp(mnem, machInst, __opClass)
+    PredMacroOp(mnem, machInst, __opClass),
+    eSize(0), dataSize(0), numStructElems(0), index(0),
+    wb(false), replicate(false)
+
 {
     RegIndex vx = NumFloatV8ArchRegs / 4;
     RegIndex rnsp = (RegIndex) makeSP((IntRegIndex) rn);
@@ -1352,7 +1355,9 @@ VstSingleOp64::VstSingleOp64(const char *mnem, ExtMachInst machInst,
                              RegIndex rm, uint8_t eSize, uint8_t dataSize,
                              uint8_t numStructElems, uint8_t index, bool wb,
                              bool replicate) :
-    PredMacroOp(mnem, machInst, __opClass)
+    PredMacroOp(mnem, machInst, __opClass),
+    eSize(0), dataSize(0), numStructElems(0), index(0),
+    wb(false), replicate(false)
 {
     RegIndex vx = NumFloatV8ArchRegs / 4;
     RegIndex rnsp = (RegIndex) makeSP((IntRegIndex) rn);
diff --git a/src/arch/arm/insts/mem64.hh b/src/arch/arm/insts/mem64.hh
index 21c1e1ea8..933d34576 100644
--- a/src/arch/arm/insts/mem64.hh
+++ b/src/arch/arm/insts/mem64.hh
@@ -101,7 +101,7 @@ class Memory64 : public MightBeMicro64
     Memory64(const char *mnem, ExtMachInst _machInst, OpClass __opClass,
              IntRegIndex _dest, IntRegIndex _base)
         : MightBeMicro64(mnem, _machInst, __opClass),
-          dest(_dest), base(_base), uops(NULL)
+          dest(_dest), base(_base), uops(NULL), memAccessFlags(0)
     {
         baseIsSP = isSP(_base);
     }
diff --git a/src/arch/arm/insts/misc.hh b/src/arch/arm/insts/misc.hh
index 0c864559e..c2dcaa847 100644
--- a/src/arch/arm/insts/misc.hh
+++ b/src/arch/arm/insts/misc.hh
@@ -294,7 +294,6 @@ class RegImmImmOp : public PredOp
 {
   protected:
     IntRegIndex dest;
-    IntRegIndex op1;
     uint64_t imm1;
     uint64_t imm2;
 
diff --git a/src/arch/arm/insts/pred_inst.hh b/src/arch/arm/insts/pred_inst.hh
index 8a335879b..09ebbb120 100644
--- a/src/arch/arm/insts/pred_inst.hh
+++ b/src/arch/arm/insts/pred_inst.hh
@@ -312,7 +312,7 @@ class PredMacroOp : public PredOp
     /// Constructor
     PredMacroOp(const char *mnem, ExtMachInst _machInst, OpClass __opClass) :
                 PredOp(mnem, _machInst, __opClass),
-                numMicroops(0)
+                numMicroops(0), microOps(nullptr)
     {
         // We rely on the subclasses of this object to handle the
         // initialization of the micro-operations, since they are
diff --git a/src/arch/arm/isa/insts/misc64.isa b/src/arch/arm/isa/insts/misc64.isa
index e063813c7..7e88bebbb 100644
--- a/src/arch/arm/isa/insts/misc64.isa
+++ b/src/arch/arm/isa/insts/misc64.isa
@@ -84,7 +84,8 @@ let {{
         diff += intWidth;
     }
     uint64_t topBits M5_VAR_USED = ~mask(diff+1);
-    uint64_t result = (Op164 >> imm1) | (Op164 << (intWidth - imm1));
+    uint64_t result = imm1 == 0 ? Op164 :
+                      (Op164 >> imm1) | (Op164 << (intWidth - imm1));
     result &= bitMask;
     '''
 
diff --git a/src/arch/arm/isa/insts/neon64_mem.isa b/src/arch/arm/isa/insts/neon64_mem.isa
index af31d959e..4d3241226 100644
--- a/src/arch/arm/isa/insts/neon64_mem.isa
+++ b/src/arch/arm/isa/insts/neon64_mem.isa
@@ -185,7 +185,8 @@ let {{
         if name == 'deint_neon_uop':
 
             eCode = '''
-                VReg input[4];  // input data from scratch area
+                // input data from scratch area
+                VReg input[4] = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
                 VReg output[2];  // output data to arch. SIMD regs
                 VReg temp;
                 temp.lo = 0;
@@ -270,7 +271,8 @@ let {{
         elif name == 'int_neon_uop':
 
             eCode = '''
-                VReg input[4];  // input data from arch. SIMD regs
+                // input data from arch. SIMD regs
+                VReg input[4] = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
                 VReg output[2];  // output data to scratch area
             '''
 
@@ -332,7 +334,8 @@ let {{
         elif name == 'unpack_neon_uop':
 
             eCode = '''
-                VReg input[4];  //input data from scratch area
+                //input data from scratch area
+                VReg input[4] = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
                 VReg output[2];  //output data to arch. SIMD regs
             '''
 
@@ -398,7 +401,8 @@ let {{
         elif name == 'pack_neon_uop':
 
             eCode = '''
-                VReg input[4];  // input data from arch. SIMD regs
+                // input data from arch. SIMD regs
+                VReg input[4] = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
                 VReg output[2];  // output data to scratch area
             '''
 
diff --git a/src/arch/arm/linux/system.cc b/src/arch/arm/linux/system.cc
index 66278681d..e9586f199 100644
--- a/src/arch/arm/linux/system.cc
+++ b/src/arch/arm/linux/system.cc
@@ -61,9 +61,9 @@ using namespace ArmISA;
 using namespace Linux;
 
 LinuxArmSystem::LinuxArmSystem(Params *p)
-    : ArmSystem(p),
+    : ArmSystem(p), dumpStatsPCEvent(nullptr),
       enableContextSwitchStatsDump(p->enable_context_switch_stats_dump),
-      kernelPanicEvent(NULL), kernelOopsEvent(NULL),
+      taskFile(nullptr), kernelPanicEvent(nullptr), kernelOopsEvent(nullptr),
       bootReleaseAddr(p->boot_release_addr)
 {
     if (p->panic_on_panic) {
diff --git a/src/arch/arm/pmu.cc b/src/arch/arm/pmu.cc
index bb50ec547..0fc903e9d 100644
--- a/src/arch/arm/pmu.cc
+++ b/src/arch/arm/pmu.cc
@@ -95,7 +95,7 @@ PMU::addEventProbe(unsigned int id, SimObject *obj, const char *probe_name)
     // Flag the event as available in the PMCEID register if it is an
     // architected event.
     if (id < 0x40)
-        reg_pmceid |= (1 << id);
+        reg_pmceid |= (ULL(1) << id);
 }
 
 void
diff --git a/src/arch/arm/process.hh b/src/arch/arm/process.hh
index 1b77f9e4a..39e971c62 100644
--- a/src/arch/arm/process.hh
+++ b/src/arch/arm/process.hh
@@ -67,7 +67,6 @@ class ArmLiveProcess : public LiveProcess
 class ArmLiveProcess32 : public ArmLiveProcess
 {
   protected:
-    ObjectFile::Arch arch;
     ArmLiveProcess32(LiveProcessParams * params, ObjectFile *objFile,
                      ObjectFile::Arch _arch);
 
@@ -84,7 +83,6 @@ class ArmLiveProcess32 : public ArmLiveProcess
 class ArmLiveProcess64 : public ArmLiveProcess
 {
   protected:
-    ObjectFile::Arch arch;
     ArmLiveProcess64(LiveProcessParams * params, ObjectFile *objFile,
                      ObjectFile::Arch _arch);
 
diff --git a/src/arch/arm/remote_gdb.cc b/src/arch/arm/remote_gdb.cc
index 74c3c7ff3..86dd5a725 100644
--- a/src/arch/arm/remote_gdb.cc
+++ b/src/arch/arm/remote_gdb.cc
@@ -160,7 +160,7 @@ using namespace std;
 using namespace ArmISA;
 
 RemoteGDB::RemoteGDB(System *_system, ThreadContext *tc)
-    : BaseRemoteGDB(_system, tc, MAX_NUMREGS)
+    : BaseRemoteGDB(_system, tc, MAX_NUMREGS), notTakenBkpt(0), takenBkpt(0)
 {
 }
 
diff --git a/src/arch/arm/stage2_lookup.hh b/src/arch/arm/stage2_lookup.hh
index 657392ea9..6706b4724 100755
--- a/src/arch/arm/stage2_lookup.hh
+++ b/src/arch/arm/stage2_lookup.hh
@@ -80,8 +80,8 @@ class Stage2LookUp : public BaseTLB::Translation
         bool _functional, TLB::ArmTranslationType _tranType) :
         stage1Tlb(s1Tlb), stage2Tlb(s2Tlb), stage1Te(s1Te), s1Req(_req),
         transState(_transState), mode(_mode), timing(_timing),
-        functional(_functional), tranType(_tranType), fault(NoFault),
-        complete(false), selfDelete(false)
+        functional(_functional), tranType(_tranType), stage2Te(nullptr),
+        fault(NoFault), complete(false), selfDelete(false)
     {
         req.setVirt(0, s1Te.pAddr(s1Req->getVaddr()), s1Req->getSize(),
                     s1Req->getFlags(), s1Req->masterId(), 0);
diff --git a/src/arch/arm/stage2_mmu.cc b/src/arch/arm/stage2_mmu.cc
index 98eeedb78..672fccdbe 100755
--- a/src/arch/arm/stage2_mmu.cc
+++ b/src/arch/arm/stage2_mmu.cc
@@ -108,7 +108,7 @@ Stage2MMU::readDataTimed(ThreadContext *tc, Addr descAddr,
 
 Stage2MMU::Stage2Translation::Stage2Translation(Stage2MMU &_parent,
         uint8_t *_data, Event *_event, Addr _oVAddr)
-    : data(_data), event(_event), parent(_parent), oVAddr(_oVAddr),
+    : data(_data), numBytes(0), event(_event), parent(_parent), oVAddr(_oVAddr),
     fault(NoFault)
 {
 }
diff --git a/src/arch/arm/system.cc b/src/arch/arm/system.cc
index 00d9d7613..398aa408c 100644
--- a/src/arch/arm/system.cc
+++ b/src/arch/arm/system.cc
@@ -58,6 +58,7 @@ ArmSystem::ArmSystem(Params *p)
       _haveLPAE(p->have_lpae),
       _haveVirtualization(p->have_virtualization),
       _haveGenericTimer(p->have_generic_timer),
+      _genericTimer(nullptr),
       _highestELIs64(p->highest_el_is_64),
       _resetAddr64(p->reset_addr_64),
       _physAddrRange64(p->phys_addr_range_64),
diff --git a/src/arch/arm/table_walker.cc b/src/arch/arm/table_walker.cc
index adff57fdf..30fdf9811 100644
--- a/src/arch/arm/table_walker.cc
+++ b/src/arch/arm/table_walker.cc
@@ -90,7 +90,15 @@ TableWalker::~TableWalker()
     ;
 }
 
-TableWalker::WalkerState::WalkerState() : stage2Tran(NULL), l2Desc(l1Desc)
+TableWalker::WalkerState::WalkerState() :
+    tc(nullptr), aarch64(false), el(EL0), physAddrRange(0), req(nullptr),
+    asid(0), vmid(0), isHyp(false), transState(nullptr),
+    vaddr(0), vaddr_tainted(0), isWrite(false), isFetch(false), isSecure(false),
+    secureLookup(false), rwTable(false), userTable(false), xnTable(false),
+    pxnTable(false), stage2Req(false), doingStage2(false),
+    stage2Tran(nullptr), timing(false), functional(false),
+    mode(BaseTLB::Read), tranType(TLB::NormalTran), l2Desc(l1Desc),
+    delayed(false), tableWalker(nullptr)
 {
 }
 
diff --git a/src/arch/arm/table_walker.hh b/src/arch/arm/table_walker.hh
index bad6e5e7a..b5d67c9a1 100644
--- a/src/arch/arm/table_walker.hh
+++ b/src/arch/arm/table_walker.hh
@@ -106,7 +106,7 @@ class TableWalker : public MemObject
         bool _dirty;
 
         /** Default ctor */
-        L1Descriptor()
+        L1Descriptor() : data(0), _dirty(false)
         {
             lookupLevel = L1;
         }
@@ -250,12 +250,13 @@ class TableWalker : public MemObject
         bool _dirty;
 
         /** Default ctor */
-        L2Descriptor()
+        L2Descriptor() : data(0), l1Parent(nullptr), _dirty(false)
         {
             lookupLevel = L2;
         }
 
-        L2Descriptor(L1Descriptor &parent) : l1Parent(&parent)
+        L2Descriptor(L1Descriptor &parent) : data(0), l1Parent(&parent),
+                                             _dirty(false)
         {
             lookupLevel = L2;
         }
diff --git a/src/arch/arm/tlb.cc b/src/arch/arm/tlb.cc
index 46f124665..c2de9ecbe 100644
--- a/src/arch/arm/tlb.cc
+++ b/src/arch/arm/tlb.cc
@@ -75,6 +75,8 @@ TLB::TLB(const ArmTLBParams *p)
       isStage2(p->is_stage2), stage2Req(false), _attr(0),
       directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
       stage2Mmu(NULL), rangeMRU(1), bootUncacheability(false),
+      aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
+      isHyp(false), asid(0), vmid(0), dacr(0),
       miscRegValid(false), curTranType(NormalTran)
 {
     tableWalker->setTlb(this);
diff --git a/src/arch/arm/types.hh b/src/arch/arm/types.hh
index 14cce8294..cebbcef69 100644
--- a/src/arch/arm/types.hh
+++ b/src/arch/arm/types.hh
@@ -223,7 +223,8 @@ namespace ArmISA
         uint8_t _nextItstate;
         uint8_t _size;
       public:
-        PCState() : flags(0), nextFlags(0), _itstate(0), _nextItstate(0)
+        PCState() : flags(0), nextFlags(0), _itstate(0), _nextItstate(0),
+                    _size(0)
         {}
 
         void
@@ -233,7 +234,8 @@ namespace ArmISA
             npc(val + (thumb() ? 2 : 4));
         }
 
-        PCState(Addr val) : flags(0), nextFlags(0), _itstate(0), _nextItstate(0)
+        PCState(Addr val) : flags(0), nextFlags(0), _itstate(0),
+                            _nextItstate(0), _size(0)
         { set(val); }
 
         bool
diff --git a/src/arch/generic/types.hh b/src/arch/generic/types.hh
index 931c07134..0381e9953 100644
--- a/src/arch/generic/types.hh
+++ b/src/arch/generic/types.hh
@@ -47,8 +47,8 @@ class PCStateBase
     Addr _pc;
     Addr _npc;
 
-    PCStateBase() {}
-    PCStateBase(Addr val) { set(val); }
+    PCStateBase() : _pc(0), _npc(0) {}
+    PCStateBase(Addr val) : _pc(0), _npc(0) { set(val); }
 
   public:
     /**
@@ -206,8 +206,8 @@ class UPCState : public SimplePCState<MachInst>
         nupc(1);
     }
 
-    UPCState() {}
-    UPCState(Addr val) { set(val); }
+    UPCState() : _upc(0), _nupc(0) {}
+    UPCState(Addr val) : _upc(0), _nupc(0) { set(val); }
 
     bool
     branching() const