From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1JraJ7-0000CH-9X
	for qemu-devel@nongnu.org; Thu, 01 May 2008 11:02:49 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1JraJ5-0000Bz-Rk
	for qemu-devel@nongnu.org; Thu, 01 May 2008 11:02:49 -0400
Received: from [199.232.76.173] (port=43359 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1JraJ5-0000Bw-N6
	for qemu-devel@nongnu.org; Thu, 01 May 2008 11:02:47 -0400
Received: from nf-out-0910.google.com ([64.233.182.191])
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <blauwirbel@gmail.com>) id 1JraJ5-0003BL-7N
	for qemu-devel@nongnu.org; Thu, 01 May 2008 11:02:47 -0400
Received: by nf-out-0910.google.com with SMTP id b2so407481nfb.12
	for <qemu-devel@nongnu.org>; Thu, 01 May 2008 08:02:46 -0700 (PDT)
Message-ID: <f43fc5580805010802o614fd763v354ff43892e98539@mail.gmail.com>
Date: Thu, 1 May 2008 18:02:46 +0300
From: "Blue Swirl" <blauwirbel@gmail.com>
Subject: Re: [Qemu-devel] Crash due to invalid env->current_tb
In-Reply-To: <20080501120241.GC13241@os.inf.tu-dresden.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20080429115614.GA15524@os.inf.tu-dresden.de>
	<f43fc5580804291009s4dea4233y472c9823f42d021c@mail.gmail.com>
	<20080429184011.GK17356@os.inf.tu-dresden.de>
	<C654F6F0-37A1-4E18-B067-7B8EBC724401@suse.de>
	<20080430151132.GB6712@os.inf.tu-dresden.de>
	<20080430152102.GC6712@os.inf.tu-dresden.de>
	<67C63B39-3EBE-4E1F-B46B-D2FE7AAC001F@suse.de>
	<f43fc5580804301121q14ab1a9bx8e944bc2ed135fcc@mail.gmail.com>
	<20080501120241.GC13241@os.inf.tu-dresden.de>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

On 5/1/08, Adam Lackorzynski <adam@os.inf.tu-dresden.de> wrote:
>
>  On Wed Apr 30, 2008 at 21:21:40 +0300, Blue Swirl wrote:
>  > The attached version survives quick tests for both Sparc32 and Sparc64.
>
>
> Ok, I did not check for 64bit targets. So what about the following,
>  works for me for arm, x86-32 and x86-64.
>
>
>  Index: cpu-exec.c
>  ===================================================================
>  --- cpu-exec.c  (revision 4276)
>  +++ cpu-exec.c  (working copy)
>
> @@ -690,7 +691,22 @@
>
>                 fp.ip = tc_ptr;
>                 fp.gp = code_gen_buffer + 2 * (1 << 20);
>                 (*(void (*)(void)) &fp)();
>  +#elif defined(__i386)
>
> +#if (TARGET_LONG_BITS == 32)
>  +#define CLOBBER ,"edx"
>   #else
>  +#define CLOBBER ,"ebx"
>  +#endif
>  +               asm volatile ("push %%ebp\n"
>  +                             "call *%1\n"
>  +                             "pop %%ebp\n"
>  +                             : "=A" (T0)
>  +                             : "a" (gen_func)
>  +                             : "ecx", "esi", "edi", "cc" CLOBBER
>  +                             );
>  +               T0 &= 0xffffffff;
>  +#undef CLOBBER
>  +#else
>                  T0 = gen_func();
>   #endif
>                  env->current_tb = NULL;
>
>
>  For 64bit target T0 is 64bits so "=a" does not work and "=A" is needed.
>  The strange thing is that I need to throw away the upper 32bits because
>  otherwise it won't work. gen_func is defined to return just long but T0
>  is unsigned long long, this seems inconsistent. The 'and' does not
>  appear in 32bit targets so it does not harm there.

This is because in this special case, T0 is not used as target CPU
temporary, but instead to return next TB address. On i386 this is 32
bits, so only EAX is needed. TCG does not touch EDX, so it contains
garbage. This also means that moving EDX to high word of T0 and then
throwing the high word away may be slightly wasteful.