From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from list by monty-python.gnu.org with tmda-scanned (Exim 4.20)
	id 19kfzn-0001ue-Bb
	for qemu-devel@nongnu.org; Thu, 07 Aug 2003 04:19:39 -0400
Received: from mail by monty-python.gnu.org with spam-scanned (Exim 4.20)
	id 19kfzG-0001re-AJ
	for qemu-devel@nongnu.org; Thu, 07 Aug 2003 04:19:38 -0400
Received: from [195.68.86.12] (helo=alcor.imaginet.fr)
	by monty-python.gnu.org with esmtp (Exim 4.20) id 19kfjS-00088l-Dm
	for qemu-devel@nongnu.org; Thu, 07 Aug 2003 04:02:46 -0400
Received: from free.fr (gw.netgem.com [195.68.2.34])
	by alcor.imaginet.fr (8.11.6+Sun/8.8.8) with ESMTP id h7783SD26245
	for <qemu-devel@nongnu.org>; Thu, 7 Aug 2003 10:03:28 +0200 (MET DST)
Message-ID: <3F32079D.6020306@free.fr>
Date: Thu, 07 Aug 2003 10:02:37 +0200
From: Fabrice Bellard <fabrice.bellard@free.fr>
MIME-Version: 1.0
Subject: Re: [Qemu-devel] powerpc hang
References: <1060210228.10894.50.camel@lxws8.ad.newisys.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Reply-To: qemu-devel@nongnu.org
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <http://mail.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://mail.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://mail.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

The branch in JUMP_TB can jump to one of two targets:

1) The next instruction which sets 'T0' to the Translation Block (TB) 
address ored with the branch index (0 or 1) and env->eip to the target 
EIP value. This is the default (and slow) case.

2) Directly to the TB corresponding to the target EIP value.

The information stored in the translation block tells where to find the 
'branch' instruction in the TB (16 bit offset from the start of the 
translated block) and which value must be stored in it to jump to the 
next instruction (another 16 bit offset).

Fabrice.

Jon Nall wrote:
> hello.
> i'm pretty new to qemu and last night set out to help debug the current
> ppc hang when using gcc3. trying to understand the code has left me with
> a question about how op_jmp_tb_next works on powerpc. would someone
> kindly walk through what should happen? i'm speficially curious about:
> 
> - how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec()
> - how the tb_jmp_offset member is ultimately used