* [Qemu-devel] powerpc hang @ 2003-08-06 22:50 Jon Nall 2003-08-07 8:02 ` Fabrice Bellard 2003-08-07 22:05 ` Jon Nall 0 siblings, 2 replies; 7+ messages in thread From: Jon Nall @ 2003-08-06 22:50 UTC (permalink / raw) To: qemu-devel [-- Attachment #1: Type: text/plain, Size: 434 bytes --] hello. i'm pretty new to qemu and last night set out to help debug the current ppc hang when using gcc3. trying to understand the code has left me with a question about how op_jmp_tb_next works on powerpc. would someone kindly walk through what should happen? i'm speficially curious about: - how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec() - how the tb_jmp_offset member is ultimately used thanks! nall. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-06 22:50 [Qemu-devel] powerpc hang Jon Nall @ 2003-08-07 8:02 ` Fabrice Bellard 2003-08-07 22:05 ` Jon Nall 1 sibling, 0 replies; 7+ messages in thread From: Fabrice Bellard @ 2003-08-07 8:02 UTC (permalink / raw) To: qemu-devel The branch in JUMP_TB can jump to one of two targets: 1) The next instruction which sets 'T0' to the Translation Block (TB) address ored with the branch index (0 or 1) and env->eip to the target EIP value. This is the default (and slow) case. 2) Directly to the TB corresponding to the target EIP value. The information stored in the translation block tells where to find the 'branch' instruction in the TB (16 bit offset from the start of the translated block) and which value must be stored in it to jump to the next instruction (another 16 bit offset). Fabrice. Jon Nall wrote: > hello. > i'm pretty new to qemu and last night set out to help debug the current > ppc hang when using gcc3. trying to understand the code has left me with > a question about how op_jmp_tb_next works on powerpc. would someone > kindly walk through what should happen? i'm speficially curious about: > > - how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec() > - how the tb_jmp_offset member is ultimately used ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-06 22:50 [Qemu-devel] powerpc hang Jon Nall 2003-08-07 8:02 ` Fabrice Bellard @ 2003-08-07 22:05 ` Jon Nall 2003-08-08 9:20 ` Christof Petig 2003-08-08 13:13 ` Jon Nall 1 sibling, 2 replies; 7+ messages in thread From: Jon Nall @ 2003-08-07 22:05 UTC (permalink / raw) To: qemu-devel [-- Attachment #1.1: Type: text/plain, Size: 557 bytes --] i believe i've fixed the hang problem (see attached patch). here's my current findings with the binaries provided with qemu and the qemu-glibc tarball. hello-i386 -> runs with or without the patch below ls-i386 -> runs with the patch below, hangs without it test-i386 -> runs with the 3 exceptions: the func_lret32 and func_iret32 tests both die with a SIGSEGV. Also i get "Unsupported syscall: 252" when the program exits. i'm looking into both of these. anyone know what changed to cause the label offsets to be off by 4? nall. [-- Attachment #1.2: qemu-ppc.diff --] [-- Type: text/plain, Size: 851 bytes --] --- dyngen.c 11 Jul 2003 15:16:56 -0000 1.26 +++ dyngen.c 7 Aug 2003 21:19:55 -0000 @@ -687,7 +687,11 @@ if (val >= start_offset && val < start_offset + copy_size) { n = strtol(p, NULL, 10); +#if ( __GNUC__ == 3) && defined(__powerpc__) + fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4); +#else fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset); +#endif } } } --- exec.h 26 Jul 2003 12:06:08 -0000 1.13 +++ exec.h 7 Aug 2003 21:19:55 -0000 @@ -210,6 +210,7 @@ label ## n:\ T0 = (long)(tbparam) + (n);\ EIP = eip;\ + EXIT_TB();\ } while (0) #else [-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-07 22:05 ` Jon Nall @ 2003-08-08 9:20 ` Christof Petig 2003-08-08 13:13 ` Jon Nall 1 sibling, 0 replies; 7+ messages in thread From: Christof Petig @ 2003-08-08 9:20 UTC (permalink / raw) To: qemu-devel Jon Nall schrieb: > i believe i've fixed the hang problem (see attached patch). here's > my current findings with the binaries provided with qemu and > the qemu-glibc tarball. This patch fixes my problems (besides not being able to run a more recent Wine without segv, but that seems to be a different story). Christof ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-07 22:05 ` Jon Nall 2003-08-08 9:20 ` Christof Petig @ 2003-08-08 13:13 ` Jon Nall 2003-08-09 2:48 ` Jon Nall 1 sibling, 1 reply; 7+ messages in thread From: Jon Nall @ 2003-08-08 13:13 UTC (permalink / raw) To: qemu-devel On Thu, Aug 07, 2003 at 05:05:45PM -0500, Jon Nall wrote: > test-i386 -> runs with the 3 exceptions: the func_lret32 and func_iret32 > tests both die with a SIGSEGV. Also i get "Unsupported syscall: > 252" when the program exits. i'm looking into both of these. > i've found a little more information: - Unsupported syscall: 252. grepping through kernel headers, it seems that i386, cris, and ppc64 are the only architectures that define a syscall for syscall 252 (__NR_exit_group) in linux 2.4. the 2.5 kernel seems to have most (all?) architectures supporting this syscall, although the actual number varies with architecture and syscall_defs.h should probably be updated with that information. - the SIGSEGV. this occurs because there are lots of uses of env->regs[R_ESP] in helper-i386.c. however, on ppc, ESP is $r17. adding: env->regs[R_ESP] = ESP; to the top of helper_ret_protected() allowed func_lret32 and func_iret32 to succeed. however, the env->regs[R_ESP] usage is strewn all over the code. Question: is it safe to replace all of these with ESP since ESP should default to env->regs[R_ESP] if there is no AREG defined for the architecture? (or more generally, is it safe to replace env->regs[XXX] with XXX?) thanks! nall. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-08 13:13 ` Jon Nall @ 2003-08-09 2:48 ` Jon Nall 2003-08-09 10:51 ` Fabrice Bellard 0 siblings, 1 reply; 7+ messages in thread From: Jon Nall @ 2003-08-09 2:48 UTC (permalink / raw) To: qemu-devel [-- Attachment #1.1: Type: text/plain, Size: 740 bytes --] On Fri, Aug 08, 2003 at 08:13:35AM -0500, Jon Nall wrote: > Question: is it safe to replace all of these with ESP since ESP should > default to env->regs[R_ESP] if there is no AREG defined for the > architecture? (or more generally, is it safe to replace env->regs[XXX] > with XXX?) i replaced all instances of env->regs[R_ESP] in helper-i386.c with ESP (see below). this allowed me to run test-i386 to completion with no errors! i'm attaching a full patch to get qemu working on ppc/gcc3, which includes this change and the changes i posted previously. NOTE: there was one instance of env->regs[E_ESP] in helper-i386.c that went unchanged -- the one in cpu_loop_exit(), since this was setting the register to ESP anyway. nall. [-- Attachment #1.2: qemu-ppc-gcc3.patch --] [-- Type: text/plain, Size: 5848 bytes --] --- dyngen.c 11 Jul 2003 15:16:56 -0000 1.26 +++ dyngen.c 9 Aug 2003 02:52:25 -0000 @@ -687,7 +687,11 @@ if (val >= start_offset && val < start_offset + copy_size) { n = strtol(p, NULL, 10); +#if ( __GNUC__ == 3) && defined(__powerpc__) + fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4); +#else fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset); +#endif } } } --- exec.h 26 Jul 2003 12:06:08 -0000 1.13 +++ exec.h 9 Aug 2003 02:52:26 -0000 @@ -210,6 +210,7 @@ label ## n:\ T0 = (long)(tbparam) + (n);\ EIP = eip;\ + EXIT_TB();\ } while (0) #else --- helper-i386.c 29 Jul 2003 20:53:01 -0000 1.11 +++ helper-i386.c 9 Aug 2003 02:52:27 -0000 @@ -285,13 +285,13 @@ /* XXX: check that enough room is available */ if (new_stack) { - old_esp = env->regs[R_ESP]; + old_esp = ESP; old_ss = env->segs[R_SS].selector; load_seg(R_SS, ss, env->eip); } else { old_esp = 0; old_ss = 0; - esp = env->regs[R_ESP]; + esp = ESP; } if (is_int) old_eip = next_eip; @@ -300,7 +300,7 @@ old_cs = env->segs[R_CS].selector; load_seg(R_CS, selector, env->eip); env->eip = offset; - env->regs[R_ESP] = esp - push_size; + ESP = esp - push_size; ssp = env->segs[R_SS].base + esp; if (shift == 1) { int old_eflags; @@ -374,7 +374,7 @@ ptr = dt->base + intno * 4; offset = lduw(ptr); selector = lduw(ptr + 2); - esp = env->regs[R_ESP]; + esp = ESP; ssp = env->segs[R_SS].base; if (is_int) old_eip = next_eip; @@ -389,7 +389,7 @@ stw(ssp + (esp & 0xffff), old_eip); /* update processor state */ - env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff); + ESP = (ESP & ~0xffff) | (esp & 0xffff); env->eip = offset; env->segs[R_CS].selector = selector; env->segs[R_CS].base = (uint8_t *)(selector << 4); @@ -784,7 +784,7 @@ new_cs = T0; new_eip = T1; - esp = env->regs[R_ESP]; + esp = ESP; esp_mask = 0xffffffff; if (!(env->segs[R_SS].flags & DESC_B_MASK)) esp_mask = 0xffff; @@ -802,9 +802,9 @@ } if (!(env->segs[R_SS].flags & DESC_B_MASK)) - env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff); + ESP = (ESP & ~0xffff) | (esp & 0xffff); else - env->regs[R_ESP] = esp; + ESP = esp; env->eip = new_eip; env->segs[R_CS].selector = new_cs; env->segs[R_CS].base = (uint8_t *)(new_cs << 4); @@ -846,7 +846,7 @@ if (!(e2 & DESC_P_MASK)) raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc); - sp = env->regs[R_ESP]; + sp = ESP; if (!(env->segs[R_SS].flags & DESC_B_MASK)) sp &= 0xffff; ssp = env->segs[R_SS].base + sp; @@ -868,9 +868,9 @@ raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc); /* from this point, not restartable */ if (!(env->segs[R_SS].flags & DESC_B_MASK)) - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff); + ESP = (ESP & 0xffff0000) | (sp & 0xffff); else - env->regs[R_ESP] = sp; + ESP = sp; env->segs[R_CS].base = sc1.base; env->segs[R_CS].limit = sc1.limit; env->segs[R_CS].flags = sc1.flags; @@ -938,7 +938,7 @@ param_count = e2 & 0x1f; push_size = ((param_count * 2) + 8) << shift; - old_esp = env->regs[R_ESP]; + old_esp = ESP; old_ss = env->segs[R_SS].selector; if (!(env->segs[R_SS].flags & DESC_B_MASK)) old_esp &= 0xffff; @@ -995,11 +995,12 @@ load_seg(R_CS, selector, env->eip); /* from this point, not restartable if same priviledge */ if (!(env->segs[R_SS].flags & DESC_B_MASK)) - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff); + ESP = (ESP & 0xffff0000) | (sp & 0xffff); else - env->regs[R_ESP] = sp; + ESP = sp; EIP = offset; } + } /* init the segment cache in vm86 mode */ @@ -1020,7 +1021,7 @@ uint8_t *ssp; int eflags_mask; - sp = env->regs[R_ESP] & 0xffff; + sp = ESP & 0xffff; ssp = env->segs[R_SS].base + sp; if (shift == 1) { /* 32 bits */ @@ -1034,7 +1035,7 @@ new_eip = lduw(ssp); } new_esp = sp + (6 << shift); - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | + ESP = (ESP & 0xffff0000) | (new_esp & 0xffff); load_seg_vm(R_CS, new_cs); env->eip = new_eip; @@ -1053,7 +1054,7 @@ int cpl, dpl, rpl, eflags_mask; uint8_t *ssp; - sp = env->regs[R_ESP]; + sp = ESP; if (!(env->segs[R_SS].flags & DESC_B_MASK)) sp &= 0xffff; ssp = env->segs[R_SS].base + sp; @@ -1129,9 +1130,9 @@ load_seg(R_SS, new_ss, env->eip); } if (env->segs[R_SS].flags & DESC_B_MASK) - env->regs[R_ESP] = new_esp; + ESP = new_esp; else - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | + ESP = (ESP & 0xffff0000) | (new_esp & 0xffff); env->eip = new_eip; if (is_iret) { @@ -1164,7 +1165,7 @@ load_seg_vm(R_GS, new_gs); env->eip = new_eip; - env->regs[R_ESP] = new_esp; + ESP = new_esp; } void helper_iret_protected(int shift) [-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] powerpc hang 2003-08-09 2:48 ` Jon Nall @ 2003-08-09 10:51 ` Fabrice Bellard 0 siblings, 0 replies; 7+ messages in thread From: Fabrice Bellard @ 2003-08-09 10:51 UTC (permalink / raw) To: qemu-devel It should be safe. I am going to merge your patch. Thank you! Fabrice. Jon Nall wrote: > On Fri, Aug 08, 2003 at 08:13:35AM -0500, Jon Nall wrote: > >> Question: is it safe to replace all of these with ESP since ESP should >> default to env->regs[R_ESP] if there is no AREG defined for the >> architecture? (or more generally, is it safe to replace env->regs[XXX] >> with XXX?) > > > i replaced all instances of env->regs[R_ESP] in helper-i386.c with ESP > (see below). this allowed me to run test-i386 to completion with no > errors! i'm attaching a full patch to get qemu working on ppc/gcc3, > which includes this change and the changes i posted previously. > > NOTE: there was one instance of env->regs[E_ESP] in helper-i386.c that > went unchanged -- the one in cpu_loop_exit(), since this was setting the > register to ESP anyway. > > > nall. > > > ------------------------------------------------------------------------ > > --- dyngen.c 11 Jul 2003 15:16:56 -0000 1.26 > +++ dyngen.c 9 Aug 2003 02:52:25 -0000 > @@ -687,7 +687,11 @@ > > if (val >= start_offset && val < start_offset + copy_size) { > n = strtol(p, NULL, 10); > +#if ( __GNUC__ == 3) && defined(__powerpc__) > + fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4); > +#else > fprintf(outfile, " label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset); > +#endif > } > } > } > --- exec.h 26 Jul 2003 12:06:08 -0000 1.13 > +++ exec.h 9 Aug 2003 02:52:26 -0000 > @@ -210,6 +210,7 @@ > label ## n:\ > T0 = (long)(tbparam) + (n);\ > EIP = eip;\ > + EXIT_TB();\ > } while (0) > > #else > --- helper-i386.c 29 Jul 2003 20:53:01 -0000 1.11 > +++ helper-i386.c 9 Aug 2003 02:52:27 -0000 > @@ -285,13 +285,13 @@ > > /* XXX: check that enough room is available */ > if (new_stack) { > - old_esp = env->regs[R_ESP]; > + old_esp = ESP; > old_ss = env->segs[R_SS].selector; > load_seg(R_SS, ss, env->eip); > } else { > old_esp = 0; > old_ss = 0; > - esp = env->regs[R_ESP]; > + esp = ESP; > } > if (is_int) > old_eip = next_eip; > @@ -300,7 +300,7 @@ > old_cs = env->segs[R_CS].selector; > load_seg(R_CS, selector, env->eip); > env->eip = offset; > - env->regs[R_ESP] = esp - push_size; > + ESP = esp - push_size; > ssp = env->segs[R_SS].base + esp; > if (shift == 1) { > int old_eflags; > @@ -374,7 +374,7 @@ > ptr = dt->base + intno * 4; > offset = lduw(ptr); > selector = lduw(ptr + 2); > - esp = env->regs[R_ESP]; > + esp = ESP; > ssp = env->segs[R_SS].base; > if (is_int) > old_eip = next_eip; > @@ -389,7 +389,7 @@ > stw(ssp + (esp & 0xffff), old_eip); > > /* update processor state */ > - env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff); > + ESP = (ESP & ~0xffff) | (esp & 0xffff); > env->eip = offset; > env->segs[R_CS].selector = selector; > env->segs[R_CS].base = (uint8_t *)(selector << 4); > @@ -784,7 +784,7 @@ > > new_cs = T0; > new_eip = T1; > - esp = env->regs[R_ESP]; > + esp = ESP; > esp_mask = 0xffffffff; > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > esp_mask = 0xffff; > @@ -802,9 +802,9 @@ > } > > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > - env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff); > + ESP = (ESP & ~0xffff) | (esp & 0xffff); > else > - env->regs[R_ESP] = esp; > + ESP = esp; > env->eip = new_eip; > env->segs[R_CS].selector = new_cs; > env->segs[R_CS].base = (uint8_t *)(new_cs << 4); > @@ -846,7 +846,7 @@ > if (!(e2 & DESC_P_MASK)) > raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc); > > - sp = env->regs[R_ESP]; > + sp = ESP; > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > sp &= 0xffff; > ssp = env->segs[R_SS].base + sp; > @@ -868,9 +868,9 @@ > raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc); > /* from this point, not restartable */ > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff); > + ESP = (ESP & 0xffff0000) | (sp & 0xffff); > else > - env->regs[R_ESP] = sp; > + ESP = sp; > env->segs[R_CS].base = sc1.base; > env->segs[R_CS].limit = sc1.limit; > env->segs[R_CS].flags = sc1.flags; > @@ -938,7 +938,7 @@ > param_count = e2 & 0x1f; > push_size = ((param_count * 2) + 8) << shift; > > - old_esp = env->regs[R_ESP]; > + old_esp = ESP; > old_ss = env->segs[R_SS].selector; > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > old_esp &= 0xffff; > @@ -995,11 +995,12 @@ > load_seg(R_CS, selector, env->eip); > /* from this point, not restartable if same priviledge */ > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff); > + ESP = (ESP & 0xffff0000) | (sp & 0xffff); > else > - env->regs[R_ESP] = sp; > + ESP = sp; > EIP = offset; > } > + > } > > /* init the segment cache in vm86 mode */ > @@ -1020,7 +1021,7 @@ > uint8_t *ssp; > int eflags_mask; > > - sp = env->regs[R_ESP] & 0xffff; > + sp = ESP & 0xffff; > ssp = env->segs[R_SS].base + sp; > if (shift == 1) { > /* 32 bits */ > @@ -1034,7 +1035,7 @@ > new_eip = lduw(ssp); > } > new_esp = sp + (6 << shift); > - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | > + ESP = (ESP & 0xffff0000) | > (new_esp & 0xffff); > load_seg_vm(R_CS, new_cs); > env->eip = new_eip; > @@ -1053,7 +1054,7 @@ > int cpl, dpl, rpl, eflags_mask; > uint8_t *ssp; > > - sp = env->regs[R_ESP]; > + sp = ESP; > if (!(env->segs[R_SS].flags & DESC_B_MASK)) > sp &= 0xffff; > ssp = env->segs[R_SS].base + sp; > @@ -1129,9 +1130,9 @@ > load_seg(R_SS, new_ss, env->eip); > } > if (env->segs[R_SS].flags & DESC_B_MASK) > - env->regs[R_ESP] = new_esp; > + ESP = new_esp; > else > - env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | > + ESP = (ESP & 0xffff0000) | > (new_esp & 0xffff); > env->eip = new_eip; > if (is_iret) { > @@ -1164,7 +1165,7 @@ > load_seg_vm(R_GS, new_gs); > > env->eip = new_eip; > - env->regs[R_ESP] = new_esp; > + ESP = new_esp; > } > > void helper_iret_protected(int shift) > > > ------------------------------------------------------------------------ > > _______________________________________________ > Qemu-devel mailing list > Qemu-devel@nongnu.org > http://mail.nongnu.org/mailman/listinfo/qemu-devel -- Fabrice. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2003-08-09 10:53 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2003-08-06 22:50 [Qemu-devel] powerpc hang Jon Nall 2003-08-07 8:02 ` Fabrice Bellard 2003-08-07 22:05 ` Jon Nall 2003-08-08 9:20 ` Christof Petig 2003-08-08 13:13 ` Jon Nall 2003-08-09 2:48 ` Jon Nall 2003-08-09 10:51 ` Fabrice Bellard
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).