[Qemu-devel] tcg/{ppc, s390, sparc}: branch target and code retranslation

[Aurelien Jarno <aurelien@aurel32.net>]

Hi,

I have just sent a tcg/arm patch concerning code retranslation. You
might want to look at the description (copied below), as from a first
glance ppc, s390 and sparc TCG targets might be affected. If you see
guest kernel panics, some segmentation fault of qemu or in the guest,
strange behaviors, that happen randomly and that looks difficult to
debug it might be the issue.

Aurelien


| QEMU uses code retranslation to restore the CPU state when an exception
| happens. For it to work the retranslation must not modify the generated
| code. This is what is currently implemented in ARM TCG.
|
| However on CPU that don't have icache/dcache/memory synchronised like
| ARM, this requirement is stronger and code retranslation must not modify
| the generated code "atomically", as the cache line might be flushed
| at any moment (interrupt, exception, task switching), even if not
| triggered by QEMU. The probability for this to happen is very low, and
| depends on cache size and associativiy, machine load, interrupts, so the
| symptoms are might happen randomly.
|
| This requirement is currently not followed in tcg/arm, for the
| load/store code, which basically has the following structure:
|   1) tlb access code is written
|   2) conditional fast path code is written
|   3) branch is written with a temporary target
|   4) slow path code is written
|   5) branch target is updated
| The cache lines corresponding to the retranslated code is not flushed
| after code retranslation as the generated code is supposed to be the
| same. However if the cache line corresponding to the branch instruction
| is flushed between step 3 and 5, and is not flushed again before the
| code is executed again, the branch target is wrong. In the guest, the
| symptoms are MMU page fault at a random addresses, which leads to
| kernel page fault or segmentation faults.

-- 
Aurelien Jarno	                        GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net