)]}'
{
  "commit": "c69806ab82760a2e5ca880d41e8786276c838152",
  "tree": "9d30c31f8cd506a0f5fe9abe42dc1099a874139a",
  "parents": [
    "497aebb99e0700ba30b9b8d1e86f3452dcb18b28"
  ],
  "author": {
    "name": "Aurelien Jarno",
    "email": "aurelien@aurel32.net",
    "time": "Thu Jan 06 22:43:13 2011 +0100"
  },
  "committer": {
    "name": "Aurelien Jarno",
    "email": "aurelien@aurel32.net",
    "time": "Sat Jan 08 16:39:47 2011 +0100"
  },
  "message": "tcg/arm: fix branch target change during code retranslation\n\nQEMU uses code retranslation to restore the CPU state when an exception\nhappens. For it to work the retranslation must not modify the generated\ncode. This is what is currently implemented in ARM TCG.\n\nHowever on CPU that don\u0027t have icache/dcache/memory synchronised like\nARM, this requirement is stronger and code retranslation must not modify\nthe generated code \"atomically\", as the cache line might be flushed\nat any moment (interrupt, exception, task switching), even if not\ntriggered by QEMU. The probability for this to happen is very low, and\ndepends on cache size and associativiy, machine load, interrupts, so the\nsymptoms are might happen randomly.\n\nThis requirement is currently not followed in tcg/arm, for the\nload/store code, which basically has the following structure:\n  1) tlb access code is written\n  2) conditional fast path code is written\n  3) branch is written with a temporary target\n  4) slow path code is written\n  5) branch target is updated\nThe cache lines corresponding to the retranslated code is not flushed\nafter code retranslation as the generated code is supposed to be the\nsame. However if the cache line corresponding to the branch instruction\nis flushed between step 3 and 5, and is not flushed again before the\ncode is executed again, the branch target is wrong. In the guest, the\nsymptoms are MMU page fault at a random addresses, which leads to\nkernel page fault or segmentation faults.\n\nThe patch fixes this issue by avoiding writing the branch target until\nit is known, that is by writing only the branch instruction first, and\nlater only the offset.\n\nThis fixes booting linux guests on ARM hosts (tested: arm, i386, mips,\nmipsel, sh4, sparc).\n\nAcked-by: Edgar E. Iglesias \u003cedgar.iglesias@gmail.com\u003e\nSigned-off-by: Aurelien Jarno \u003caurelien@aurel32.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a3af5b222e5638b917b6ac9c1d15af4250fb2113",
      "old_mode": 33188,
      "old_path": "tcg/arm/tcg-target.c",
      "new_id": "9def2e58fbc27295da6b34d7d3158df056abc21e",
      "new_mode": 33188,
      "new_path": "tcg/arm/tcg-target.c"
    }
  ]
}