From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1Njw5R-0004bt-5A
	for qemu-devel@nongnu.org; Tue, 23 Feb 2010 09:50:09 -0500
Received: from [199.232.76.173] (port=39799 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Njw5Q-0004bb-NE
	for qemu-devel@nongnu.org; Tue, 23 Feb 2010 09:50:08 -0500
Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim
	4.60) (envelope-from <jay.foad@gmail.com>) id 1Njw5O-0001xC-4t
	for qemu-devel@nongnu.org; Tue, 23 Feb 2010 09:50:08 -0500
Received: from mail-bw0-f218.google.com ([209.85.218.218]:34067)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <jay.foad@gmail.com>) id 1Njw5N-0001wM-Ro
	for qemu-devel@nongnu.org; Tue, 23 Feb 2010 09:50:06 -0500
Received: by bwz10 with SMTP id 10so2642150bwz.2
	for <qemu-devel@nongnu.org>; Tue, 23 Feb 2010 06:50:03 -0800 (PST)
MIME-Version: 1.0
Date: Tue, 23 Feb 2010 14:50:03 +0000
Message-ID: <ee2e06e91002230650l588c7304p61d5b9a312fd4f18@mail.gmail.com>
From: Jay Foad <jay.foad@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [Qemu-devel] gcc 4.4 miscompiling cpu_exec() ?
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

I'm building QEMU mipsel-linux-user with Ubuntu's GCC 4.4 on an x86
host. Whenever I try to run a trivial MIPS executable, QEMU segfaults
in cpu_loop() shortly after the call to cpu_mips_exec().

The problem seems to be that cpu_exec() doesn't preserve ebp. It tries to:

    saved_env_reg = (host_reg_t) env;

where env is a global variable decorated with asm("ebp"). This saves
ebp to the stack, but later on, in some function inlined into
cpu_exec(), the value on the stack gets overwritten with something
else.

Has anyone else seen this?

The full GCC version string is:

gcc (Ubuntu 4.4.1-4ubuntu9) 4.4.1

The following versions of GCC don't seem to suffer from the same problem:

gcc-4.1 (GCC) 4.1.3 20080704 (prerelease) (Ubuntu 4.1.2-27ubuntu1)
gcc-4.2 (GCC) 4.2.4 (Ubuntu 4.2.4-5ubuntu1)
gcc-4.3 (Ubuntu 4.3.4-5ubuntu1) 4.3.4

Thanks,
Jay.