RE: [Qemu-devel] Re: strange crash on FreeBSD-current/amd64 (pointertruncation?)

[Paul Robinson]

> From: 
> address@hidden 
> [mailto:address@hidden
> rg] On Behalf Of Thiemo Seufer
> Sent: 02 February 2007 04:02
> To: Juergen Lock
> Cc: address@hidden
> Subject: Re: [Qemu-devel] Re: strange crash on 
> FreeBSD-current/amd64 (pointertruncation?)
> 
> Juergen Lock wrote:
> > On Wed, Jan 24, 2007 at 09:00:19PM +0100, Juergen Lock wrote:
> > > Hi!
> > > 
> > >  I got a report of qemu segfaulting here on FreeBSD-current/amd64:
> > > 
> > > > #0  main_loop () at 
> /usr/ports-cvs/emulators/qemu/work/qemu-snapshot-2007-01-11_05
> /vl.c:6125
> > > > 6125                    env = env->next_cpu;
> > > > [New Thread 0x801e10190 (LWP 100214)]
> > > > (gdb) print env
> > > > $1 = (CPUX86State *) 0xac10000
> > > > (gdb) print first_cpu
> > > > $2 = (CPUX86State *) 0x80ac10000
> > 
> > Ok Jung-uk Kim found the following fix: (Thanx!)
> > 
> > --- qemu/cpu-exec.c.orig    Wed Jan 31 16:58:03 2007
> > +++ qemu/cpu-exec.c Wed Jan 31 17:08:11 2007
> > @@ -226,9 +226,9 @@
> >  
> >  int cpu_exec(CPUState *env1)
> >  {
> > -    int saved_T0, saved_T1;
> > +    long saved_T0, saved_T1;
> >  #if defined(reg_T2)
> > -    int saved_T2;
> > +    long saved_T2;
> 
> I used target_ulong instead.
> 
> 
> Thiemo
> 
> 
> _______________________________________________
> Qemu-devel mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/qemu-devel
> 
> 

But the T0, T1, and T2 registers are being saved for the benefit of the
host not the target.
A target_ulong is not big enough on a 64 bit host with a 32 bit target.
 

There's another, related problem here.
I've seen it on an x86_64 host with a sparc32 target but it might happen
with other 32 bit targets.

-- dyngen-exec.h --

#define AREG1 "rbx"
#define AREG2 "r12"

-- target-sparc/exec.h --

register uint32_t T0 asm(AREG1);
register uint32_t T1 asm(AREG2);

-- cpu-exec.h --

int cpu_exec(CPUState *env1)
{
        ...
        saved_T0 = T0;
        saved_T1 = T1; 
        ...
        gen_func();
        ...
        T0 = saved_T0; <---<< the upper 32 bits of %rbx are lost :-(
        T1 = saved_T1;
        ....
}

The problem is caused by the uint32_t in the definitions of T0, T1, and
T2.
Changing it to uint64_t breaks something else - I don't know what.
A solution that works for me is to add declarations to
target-sparc/exec.h

#if defined __x86_64__
register uint64_t T0_64 asm(AREG1);
register uint64_t T1_64 asm(AREG2);
#endif
#if defined __x86_64__
register uint64_t T2_64 asm(AREG3);
#endif

and then change some lines in cpu-exec.c

        unsigned long saved_T0, saved_T1, saved_T2;

        saved_T0 = T0_64;
        saved_T1 = T1_64;
        saved_T2 = T2_64;
        ...

        ...
        T2_64 = saved_T2;
        T1_64 = saved_T1;
        T0_64 = saved_T0;
        ...
        

Paul R.