[Qemu-devel] Problems with MIPS full system emulation and breakpoints

[Jason Wessel]

It seems there is an issue with the translation block flushing when 
writing to the code regions in the MIPS full system emulation.  Using a 
2.6 kernel which is basically running in single user mode, I use an 
extremely simple program:

main () {
   int i;
   for (i = 0; i < 10; i++) {
       printf("doing %i\n",i);
   }
}

/ # gdb simple_program
(gdb) break main
Breakpoint 1 at 0x400670: file simple_program.c, line 3.
(gdb) run
Starting program: /simple_program

Breakpoint 1, main () at simple_program.c:3
3               for (i = 0; i < 10; i++) {
(gdb) n
4               printf("doing %i\n",i);
(gdb) n
doing 0
3               for (i = 0; i < 10; i++) {
(gdb) n
doing 1

Program received signal SIGTRAP, Trace/breakpoint trap.
main () at simple_program.c:3
3               for (i = 0; i < 10; i++) {

At this point the program is trashed on the second time through the loop 
because the translated block with the breakpoint op code was executed 
instead of being flushed and translated with the correct original 
instruction.   All the single stepping and jumping over the function 
calls is done by writing a breakpoint op code in and later restoring the 
original instruction.  In the kernel access_process_vm() was used via 
ptrace to correctly read and write the breakpoints, and I have verified 
these writes are occurring.

To illustrate the problem further, I attached a patch that makes this 
problem go away.  Of course this is not the right fix, because it only 
deals with the breakpoint opcode and does not isolate the translated 
block that had the instruction that changed.  In theory you should be 
able to modify any part of the instruction code from another process 
with ptrace. 

Are there any suggestions as to how to fix this the right way?  The real 
hardware of course does not exhibit this issue.

Thanks,
Jason.

Index: qemu/target-mips/helper.c
===================================================================
--- qemu.orig/target-mips/helper.c
+++ qemu/target-mips/helper.c
@@ -360,6 +360,7 @@ void do_interrupt (CPUState *env)
         goto set_EPC;
     case EXCP_BREAK:
         cause = 9;
+        tb_flush(env);
         goto set_EPC;
     case EXCP_RI:
         cause = 10;