Re: [Qemu-devel] powerpc hang

[Fabrice Bellard <fabrice.bellard@free.fr>]

The branch in JUMP_TB can jump to one of two targets:

1) The next instruction which sets 'T0' to the Translation Block (TB) 
address ored with the branch index (0 or 1) and env->eip to the target 
EIP value. This is the default (and slow) case.

2) Directly to the TB corresponding to the target EIP value.

The information stored in the translation block tells where to find the 
'branch' instruction in the TB (16 bit offset from the start of the 
translated block) and which value must be stored in it to jump to the 
next instruction (another 16 bit offset).

Fabrice.

Jon Nall wrote:
> hello.
> i'm pretty new to qemu and last night set out to help debug the current
> ppc hang when using gcc3. trying to understand the code has left me with
> a question about how op_jmp_tb_next works on powerpc. would someone
> kindly walk through what should happen? i'm speficially curious about:
> 
> - how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec()
> - how the tb_jmp_offset member is ultimately used