Re: [Qemu-devel] [PATCH] TCG S/390 backend

[Ulrich Hecht <uli@suse.de>]

On Tuesday 05 May 2009, malc wrote:
> On Tue, 5 May 2009, Ulrich Hecht wrote:
> > Now i386, AMD64, ARM, SH4, and m68k system emulators work. MIPS
> > works at least as well as on an AMD64 host, i.e. the test image from
> > qemu.org just
>
> Should work with '-M mips'.

It complains about a missing "mips_bios.bin" then, which isn't in 
pc-bios.

> > sits there without doing anything. The SPARC test image fails with a
> > memory access exception in the target system, but works on an AMD64
> > host, so there probably still is a bug somewhere in the backend.
>
> Tried to compare `-d in_asm' outputs of S390/AMD64 when using
> deterministic execution (`-icount N')?

I found the problem: TCG does not zero- or sign-extend arguments to 
function calls. Unlike, for instance, AMD64, 32-bit arithmetic ops on 
S/390 leave the upper 32 bits of the destination register untouched, so 
there could be any kind of garbage there. If a helper taking a 64-bit 
argument is called with the result of such an operation, stuff breaks. 
IMO, TCG should do the extension in tcg_reg_alloc_call(), but that seems 
to be impossible because it has no information on the types of the input 
arguments the callee expects. Working around this in the backend is 
hardly possible as it does not have the information either.

I have the suspicion that even on other 64-bit hosts, this only works by 
accident (if it does at all): Even if the 32-bit arithmetic op does sign 
extension, what if the function argument is a pointer? Depending on the 
address, the function may get a value with a lot of F's in front...

Any ideas?

CU
Uli

-- 
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nürnberg)