summaryrefslogtreecommitdiff
path: root/src/mem
diff options
context:
space:
mode:
authorAli Saidi <Ali.Saidi@ARM.com>2012-11-02 11:50:16 -0500
committerAli Saidi <Ali.Saidi@ARM.com>2012-11-02 11:50:16 -0500
commitce5766c409ca3e27e62a300b89511b9d0fcd6c18 (patch)
tree32ef02e398c9edec9ee0acb926d6fd925b3d069f /src/mem
parent1dbf9bb4ca6cc3bee68713a28778c1bdfe222f75 (diff)
downloadgem5-ce5766c409ca3e27e62a300b89511b9d0fcd6c18.tar.xz
mem: fix use after free issue in memories until 4-phase work complete.
Diffstat (limited to 'src/mem')
-rw-r--r--src/mem/simple_dram.cc9
-rw-r--r--src/mem/simple_dram.hh6
-rw-r--r--src/mem/simple_mem.cc8
-rw-r--r--src/mem/simple_mem.hh6
4 files changed, 27 insertions, 2 deletions
diff --git a/src/mem/simple_dram.cc b/src/mem/simple_dram.cc
index 42c97977a..3dc59e8e0 100644
--- a/src/mem/simple_dram.cc
+++ b/src/mem/simple_dram.cc
@@ -474,6 +474,13 @@ SimpleDRAM::printQs() const {
bool
SimpleDRAM::recvTimingReq(PacketPtr pkt)
{
+ /// @todo temporary hack to deal with memory corruption issues until
+ /// 4-phase transactions are complete
+ for (int x = 0; x < pendingDelete.size(); x++)
+ delete pendingDelete[x];
+ pendingDelete.clear();
+
+
// This is where we enter from the outside world
DPRINTF(DRAM, "Inside recvTimingReq: request %s addr %lld size %d\n",
pkt->cmdString(),pkt->getAddr(), pkt->getSize());
@@ -495,7 +502,7 @@ SimpleDRAM::recvTimingReq(PacketPtr pkt)
// simply drop inhibited packets for now
if (pkt->memInhibitAsserted()) {
DPRINTF(DRAM,"Inhibited packet -- Dropping it now\n");
- delete pkt;
+ pendingDelete.push_back(pkt);
return true;
}
diff --git a/src/mem/simple_dram.hh b/src/mem/simple_dram.hh
index 373408c2a..de597d668 100644
--- a/src/mem/simple_dram.hh
+++ b/src/mem/simple_dram.hh
@@ -453,6 +453,12 @@ class SimpleDRAM : public AbstractMemory
Stats::Formula writeRowHitRate;
Stats::Formula avgGap;
+ /** @todo this is a temporary workaround until the 4-phase code is
+ * committed. upstream caches needs this packet until true is returned, so
+ * hold onto it for deletion until a subsequent call
+ */
+ std::vector<PacketPtr> pendingDelete;
+
public:
void regStats();
diff --git a/src/mem/simple_mem.cc b/src/mem/simple_mem.cc
index e78b57928..d3a53a26f 100644
--- a/src/mem/simple_mem.cc
+++ b/src/mem/simple_mem.cc
@@ -94,10 +94,16 @@ SimpleMemory::doFunctionalAccess(PacketPtr pkt)
bool
SimpleMemory::recvTimingReq(PacketPtr pkt)
{
+ /// @todo temporary hack to deal with memory corruption issues until
+ /// 4-phase transactions are complete
+ for (int x = 0; x < pendingDelete.size(); x++)
+ delete pendingDelete[x];
+ pendingDelete.clear();
+
if (pkt->memInhibitAsserted()) {
// snooper will supply based on copy of packet
// still target's responsibility to delete packet
- delete pkt;
+ pendingDelete.push_back(pkt);
return true;
}
diff --git a/src/mem/simple_mem.hh b/src/mem/simple_mem.hh
index f1bad7d9f..ab002f270 100644
--- a/src/mem/simple_mem.hh
+++ b/src/mem/simple_mem.hh
@@ -118,6 +118,12 @@ class SimpleMemory : public AbstractMemory
EventWrapper<SimpleMemory, &SimpleMemory::release> releaseEvent;
+ /** @todo this is a temporary workaround until the 4-phase code is
+ * committed. upstream caches needs this packet until true is returned, so
+ * hold onto it for deletion until a subsequent call
+ */
+ std::vector<PacketPtr> pendingDelete;
+
public:
SimpleMemory(const SimpleMemoryParams *p);