From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:59217) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QETGD-0001kV-Pt for qemu-devel@nongnu.org; Mon, 25 Apr 2011 17:24:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QETGC-0006rO-P7 for qemu-devel@nongnu.org; Mon, 25 Apr 2011 17:24:01 -0400 Received: from hall.aurel32.net ([88.191.126.93]:41450) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QETGC-0006q9-HD for qemu-devel@nongnu.org; Mon, 25 Apr 2011 17:24:00 -0400 Date: Mon, 25 Apr 2011 22:29:27 +0200 From: Aurelien Jarno Message-ID: <20110425202927.GD21831@volta.aurel32.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Subject: Re: [Qemu-devel] tcg/tcg.c:1892: tcg fatal error List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Igor Kovalenko Cc: Laurent Desnogues , Blue Swirl , qemu-devel , Artyom Tarasenko , peter.maydell@linaro.org On Fri, Apr 22, 2011 at 06:14:06PM +0400, Igor Kovalenko wrote: > On Fri, Apr 22, 2011 at 2:39 AM, Laurent Desnogues > wrote: > > On Thu, Apr 21, 2011 at 9:45 PM, Igor Kovalenko > > wrote: > >> On Thu, Apr 21, 2011 at 7:44 PM, Laurent Desnogues > >> wrote: > >>> On Thu, Apr 21, 2011 at 4:57 PM, Artyom Tarasenko wrote: > >>>> On Tue, Apr 12, 2011 at 4:14 AM, Igor Kovalenko > >>>> wrote: > >>>>>>> Do you have public test case? > >>>>>>> It is possible to code this delay slot write test but real issue may > >>>>>>> be corruption elsewhere. > >>>> > >>>> The test case is trivial: it's just the two instructions, branch and wrpr. > >>>> > >>>>> In theory there could be multiple issues including compiler induced ones. > >>>>> I'd prefer to see some kind of reproducible testcase. > >>>> > >>>> Ok, attached a 40 byte long test (the first 32 bytes are not used and > >>>> needed only because the bios entry point is 0x20). > >>>> > >>>> $ git pull && make && sparc64-softmmu/qemu-system-sparc64 -bios > >>>> test-wrpr.bin -nographic > >>>> Already up-to-date. > >>>> make[1]: Nothing to be done for `all'. > >>>> /mnt/terra/projects/vanilla/qemu/tcg/tcg.c:1892: tcg fatal error > >>>> Aborted > >>> > >>> The problem seems to be that wrpr is using a non-local > >>> TCG tmp (cpu_tmp0). > >> > >> Just tried the test case with write to %pil - seems like write itself is OK. > >> The issue appears to be with save_state() call since adding save_state > >> to %pil case provokes the same tcg abort. > > > > The problem is that cpu_tmp0, not being a local tmp, doesn't > > need to be saved across helper calls.  This results in the > > TCG "optimizer" getting rid of it even though it's later used. > > Look at the log and you'll see what I mean :-) > > I'm not very comfortable with tcg yet. Would it be possible to teach > optimizer working with delay slots? Or do I look in the wrong place. > The problem is not on the TCG side, but on the target-sparc/translate.c side: | case 0x32: /* wrwim, V9 wrpr */ | { | if (!supervisor(dc)) | goto priv_insn; | tcg_gen_xor_tl(cpu_tmp0, cpu_src1, cpu_src2); | #ifdef TARGET_SPARC64 Here cpu_tmp0 is loaded. cpu_tmp0 is a TCG temp, which means it is not saved across TCG branches. [...] | case 6: // pstate | save_state(dc, cpu_cond); | gen_helper_wrpstate(cpu_tmp0); | dc->npc = DYNAMIC_PC; | break; save_state() calls save_npc(), which in turns might call gen_generic_branch(): | static inline void gen_generic_branch(target_ulong npc1, target_ulong npc2, |  TCGv r_cond) | { | int l1, l2; | | l1 = gen_new_label(); |  l2 = gen_new_label(); | | tcg_gen_brcondi_tl(TCG_COND_EQ, r_cond, 0, l1); | | tcg_gen_movi_tl(cpu_npc, npc1); | tcg_gen_br(l2); | | gen_set_label(l1); |  tcg_gen_movi_tl(cpu_npc, npc2); | gen_set_label(l2); | } And here is the TCG branch, which drop the TCG temp cpu_temp0. The solution is either to rewrite gen_generic_branch() without TCG branches, or to use a TCG temp local instead of a TCG temp. -- Aurelien Jarno GPG: 1024D/F1BCDB73 aurelien@aurel32.net http://www.aurel32.net