tcg/aarch64: Reorg goto_tb implementation
authorRichard Henderson <richard.henderson@linaro.org>
Mon, 5 Dec 2022 23:26:23 +0000 (17:26 -0600)
committerRichard Henderson <richard.henderson@linaro.org>
Tue, 17 Jan 2023 20:36:02 +0000 (10:36 -1000)
commitd59d83a1c38869b1e1a4f957eb939aaa8a342721
treed00d1b33561652736b040d92961a89653f32fa72
parent2fd2e78d1b5281d589eabdf31a21166c80bebd80
tcg/aarch64: Reorg goto_tb implementation

The old implementation replaces two insns, swapping between

b <dest>
nop
br x30
and
adrp x30, <dest>
addi x30, x30, lo12:<dest>
br x30

There is a race condition in which a thread could be stopped at
the PC of the second insn, and when restarted does not see the
complete address computation and branches to nowhere.

The new implemetation replaces only one insn, swapping between

b <dest>
br tmp
and
ldr tmp, <jmp_addr>
br tmp

Reported-by: hev <r@hev.cc>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
tcg/aarch64/tcg-target.c.inc
tcg/aarch64/tcg-target.h