On 2/6/24 23:18, Jason Chien wrote:
The original implementation sets $pc to the address read from the jump vector table first and links $ra with the address of the next instruction after the updated $pc. After jumping to the updated $pc and executing the next ret instruction, the program jumps to $ra, which is in the same function currently executing, which results in an infinite loop. This commit reverses the two action. Firstly, $ra is updated with the address of the next instruction after $pc, and sets $pc to the address read from the jump vector table.
This is unlikely to be correct in the case the vector table read faults, leaving $ra updated. I guess this got broken with CF_PCREL. Anyway, the solution is to use a temporary...
- /* - * Update pc to current for the non-unwinding exception - * that might come from cpu_ld*_code() in the helper. - */ - gen_update_pc(ctx, 0); - gen_helper_cm_jalt(cpu_pc, cpu_env, tcg_constant_i32(a->index));
... here and then ...
@@ -307,6 +300,13 @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a) gen_set_gpr(ctx, xRA, succ_pc); }
... copy the temp to cpu_pc here.
tcg_gen_lookup_and_goto_ptr(); ctx->base.is_jmp = DISAS_NORETURN; return true;
r~