[Qemu-devel] [4547] A branch insn must not overwrite the branch target before relocation .

[Qemu-devel] [4547] A branch insn must not overwrite the branch target before relocation .

[Andrzej Zaborowski]

Revision: 4547
          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=4547
Author:   balrog
Date:     2008-05-23 18:50:44 +0000 (Fri, 23 May 2008)

Log Message:
-----------
A branch insn must not overwrite the branch target before relocation.

When a branch to label is translated it generates a reloc that is filled in
when the label is translated.  However, when handling an exception and
searching for the pc we abort the translation early and we sometimes
translate the branch but not the corresponding label and so no relocation
is done.  When the block is executed again the branch points to no-where.

It seems tcg/sparc/ is going to suffer from the same issue.

Modified Paths:
--------------
    trunk/tcg/arm/tcg-target.c

Modified: trunk/tcg/arm/tcg-target.c
===================================================================
--- trunk/tcg/arm/tcg-target.c	2008-05-23 18:10:51 UTC (rev 4546)
+++ trunk/tcg/arm/tcg-target.c	2008-05-23 18:50:44 UTC (rev 4547)
@@ -78,8 +78,8 @@
         tcg_abort();
 
     case R_ARM_PC24:
-        *(uint32_t *) code_ptr |=
-                ((value - ((tcg_target_long) code_ptr + 8)) >> 2) & 0xffffff;
+        *(uint32_t *) code_ptr |= (*(uint32_t *) code_ptr & 0xff000000) |
+                (((value - ((tcg_target_long) code_ptr + 8)) >> 2) & 0xffffff);
         break;
     }
 }
@@ -272,6 +272,17 @@
                     (((offset - 8) >> 2) & 0x00ffffff));
 }
 
+static inline void tcg_out_b_noaddr(TCGContext *s, int cond)
+{
+#ifdef WORDS_BIGENDIAN
+    tcg_out8(s, (cond << 4) | 0x0a);
+    s->code_ptr += 3;
+#else
+    s->code_ptr += 3;
+    tcg_out8(s, (cond << 4) | 0x0a);
+#endif
+}
+
 static inline void tcg_out_bl(TCGContext *s, int cond, int32_t offset)
 {
     tcg_out32(s, (cond << 28) | 0x0b000000 |
@@ -734,7 +745,7 @@
     } else {
         /* Probably this should be preferred even for COND_AL... */
         tcg_out_reloc(s, s->code_ptr, R_ARM_PC24, label_index, 31337);
-        tcg_out_b(s, cond, 8);
+        tcg_out_b_noaddr(s, cond);
     }
 }
 

Re: [Qemu-devel] [4547] A branch insn must not overwrite the branch target before relocation .

[Paul Brook]

> A branch insn must not overwrite the branch target before relocation.

That's actually a FIXME for this (or a very closely related issue) in 
TCG_OUT_RELOCATION.

Paul