From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=60144 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q8ucl-0000wH-EB for qemu-devel@nongnu.org; Sun, 10 Apr 2011 09:24:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q8uck-0004GG-91 for qemu-devel@nongnu.org; Sun, 10 Apr 2011 09:24:19 -0400 Received: from hall.aurel32.net ([88.191.126.93]:47303) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q8uck-0004Fy-1Y for qemu-devel@nongnu.org; Sun, 10 Apr 2011 09:24:18 -0400 Date: Sun, 10 Apr 2011 15:24:15 +0200 From: Aurelien Jarno Subject: Re: [Qemu-devel] tcg/tcg.c:1892: tcg fatal error Message-ID: <20110410132415.GA6719@volta.aurel32.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline In-Reply-To: List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Artyom Tarasenko Cc: Blue Swirl , qemu-devel On Sun, Apr 10, 2011 at 02:29:59PM +0200, Artyom Tarasenko wrote: > Trying to boot some proprietary OS I get qemu-system-sparc64 crash with a > > tcg/tcg.c:1892: tcg fatal error > > error message. > > It looks like it can be a platform independent bug though, because > when a '-singlestep' option IS present, qemu doesn't crash and seems > to translate the code properly. > > (gdb) bt > #0 0x00000032c2e327f5 in raise () from /lib64/libc.so.6 > #1 0x00000032c2e33fd5 in abort () from /lib64/libc.so.6 > #2 0x000000000051933d in tcg_reg_alloc_call (s=, > def=0x89d340, opc=INDEX_op_call, args=0x10acc98, dead_iargs=3) at > qemu/tcg/tcg.c:1892 > #3 0x000000000051a557 in tcg_gen_code_common (s=0x10b8940, > gen_code_buf=0x40338b60 "I\213n@H\213] 3\355I\211\256\220") at > qemu/tcg/tcg.c:2099 > #4 tcg_gen_code (s=0x10b8940, gen_code_buf=0x40338b60 "I\213n@H\213] > 3\355I\211\256\220") at qemu/tcg/tcg.c:2142 > #5 0x00000000004d38f1 in cpu_sparc_gen_code (env=0x10cce10, > tb=0x7fffe91bc218, gen_code_size_ptr=0x7fffffffd9b4) at > qemu/translate-all.c:93 > #6 0x00000000004d1fd7 in tb_gen_code (env=0x10cce10, pc=18868776, > cs_base=18868780, flags=15, cflags=0) at qemu/exec.c:989 > #7 0x00000000004d4029 in tb_find_slow (env1=) at > qemu/cpu-exec.c:167 > #8 tb_find_fast (env1=) at cpu-exec.c:194 > #9 cpu_sparc_exec (env1=) at qemu/cpu-exec.c:556 > #10 0x0000000000408868 in tcg_cpu_exec () at qemu/cpus.c:1066 > #11 cpu_exec_all () at qemu/cpus.c:1102 > #12 0x000000000053c756 in main_loop (argc=, > argv=, envp=) at > qemu/vl.c:1430 > > I inspected ts->val_type causing the abort() case and it turned out to be 0. > > The last lines of qemu.log (without -singlestep) > IN: > 0x00000000011fe9f0: rdpr %pstate, %g1 > 0x00000000011fe9f4: wrpr %g1, 2, %pstate > -------------- > IN: > 0x00000000011fe9f8: ldub [ %o0 ], %o1 > 0x00000000011fe9fc: mov %o1, %o2 > 0x00000000011fea00: rdpr %tick, %o3 > 0x00000000011fea04: cmp %o1, %o2 > 0x00000000011fea08: be %icc, 0x11fea00 > 0x00000000011fea0c: ldub [ %o0 ], %o2 > > Search PC... > Search PC... > Search PC... > Search PC... > Search PC... > Search PC... > -------------- > IN: > 0x00000000011fe9f8: ldub [ %o0 ], %o1 > 0x00000000011fe9fc: mov %o1, %o2 > 0x00000000011fea00: rdpr %tick, %o3 > 0x00000000011fea04: cmp %o1, %o2 > 0x00000000011fea08: be %icc, 0x11fea00 > 0x00000000011fea0c: ldub [ %o0 ], %o2 > > 110521: Data Access MMU Miss (v=0068) pc=00000000011fe9f8 > npc=00000000011fe9fc SP=000000000180ae41 > pc: 00000000011fe9f8 npc: 00000000011fe9fc > > IN: > 0x00000000011fea00: rdpr %tick, %o3 > 0x00000000011fea04: cmp %o1, %o2 > 0x00000000011fea08: be %icc, 0x11fea00 > 0x00000000011fea0c: ldub [ %o0 ], %o2 > -------------- > IN: > 0x00000000011fea10: brz,pn %o2, 0x11fe9f8 > 0x00000000011fea14: mov %o2, %o4 > -------------- > IN: > 0x00000000011fea18: rdpr %tick, %o5 > 0x00000000011fea1c: cmp %o2, %o4 > 0x00000000011fea20: be %icc, 0x11fea18 > 0x00000000011fea24: ldub [ %o0 ], %o4 > -------------- > IN: > 0x00000000011fea28: brz,pn %o4, 0x11fe9f4 > 0x00000000011fea2c: wrpr %g0, %g1, %pstate > > > The crash is 100% reproducible and happens always on the same place, > so it's probably a pure TCG issue, not related on getting the > external/timer interrupts. > > Do you need any additional info? > What would be interesting would be to get the corresponding TCG code from qemu.log (-d op,op_opt). -- Aurelien Jarno GPG: 1024D/F1BCDB73 aurelien@aurel32.net http://www.aurel32.net