From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:54923) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ShN9F-0007WI-Ux for qemu-devel@nongnu.org; Wed, 20 Jun 2012 11:48:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ShN9A-0007mU-OW for qemu-devel@nongnu.org; Wed, 20 Jun 2012 11:48:49 -0400 Received: from v220110690675601.yourvserver.net ([78.47.199.172]:35239) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ShN9A-0007jq-Ht for qemu-devel@nongnu.org; Wed, 20 Jun 2012 11:48:44 -0400 Message-ID: <4FE1F0D7.4080105@weilnetz.de> Date: Wed, 20 Jun 2012 17:48:39 +0200 From: Stefan Weil MIME-Version: 1.0 References: <20120619023136.GA5187@tyr.buserror.net> <4FE013E3.6090907@weilnetz.de> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] tci: don't write zero for reloc in tci_out_label List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Blue Swirl Cc: Scott Wood , qemu-devel@nongnu.org Am 19.06.2012 20:02, schrieb Blue Swirl: > On Tue, Jun 19, 2012 at 5:53 AM, Stefan Weil wrote: >> Am 19.06.2012 04:31, schrieb Scott Wood: >> >>> If tci_out_label is called in the context of tcg_gen_code_search_pc, we >>> could be overwriting an already patched relocation with zero -- and not >>> repatch it because the set_label is past search_pc, causing a QEMU crash >>> when it tries to branch to a zero label. >>> >>> Not writing anything to the relocation area seems to be in line with >>> what >>> other backends do from the couple I looked at (x86, ppc). >> >> >> Thanks, this might fix a crash which I have seen from time to time. >> I'll run tests as soon as possible. Tested-by: Stefan Weil The patch fixes my test scenario with a guest booting a Debian ARM kernel on a x86_64 host (Linux or W64). The following command crashes while the ARM Linux guest is booting (shortly after "Freeing init memory") with SIGSEGV caused by tb_ptr == 2: $ qemu-system-arm -M versatilepb -m 192 \ -kernel vmlinuz-3.2.0-2-versatile -initrd initrd.img-3.2.0-2-versatile With the patch applied, the ARM Linux boots correctly. Blue, maybe that test also works with a SPARC host. I have copied the ARM kernel and initrd to http://qemu.weilnetz.de/arm/. Regards, Stefan W. >> >> Could you please also look at the other backends? >> >> I saw from git history that ppc once had the same bug. >> The sparc backend (and maybe others) might still have it. > > Confirmed for Sparc. > >> >> Regards, >> Stefan W. >> >> >>> >>> Signed-off-by: Scott Wood >>> --- >>> tcg/tci/tcg-target.c | 2 +- >>> 1 files changed, 1 insertions(+), 1 deletions(-) >>> >>> diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c >>> index 453f187..3c6b0f5 100644 >>> --- a/tcg/tci/tcg-target.c >>> +++ b/tcg/tci/tcg-target.c >>> @@ -487,7 +487,7 @@ static void tci_out_label(TCGContext *s, TCGArg arg) >>> assert(label->u.value); >>> } else { >>> tcg_out_reloc(s, s->code_ptr, sizeof(tcg_target_ulong), >>> arg, 0); >>> - tcg_out_i(s, 0); >>> + s->code_ptr += sizeof(tcg_target_ulong); > > I like this fix. Other similar fixes rewrote the fixed part of the > opcode and not the label, but the fixed part may cross byte > boundaries. > >>> } >>> } >>> >> >