Re: [Qemu-devel] found one tcg `bug' (was: testing r4764 svn from 2008-06-20 18:25:56 +0200 on FreeBSD)

[Juergen Lock]

In article <address@hidden> you write:
>Juergen Lock wrote:
>[snip]
>> >  (Memory corruption, right?)  I've put the end of a in_asm,out_asm log up 
>> > at
>> >    http://people.freebsd.org/~nox/qemu/tcgbug-i386host.log.txt
>> > (its long.)  That function is MD5Transform() in:
>> >    http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/kern/md5c.c?annotate=1.27
>> > in the FreeBSD 7.0 amd64 kernel on
>> > 
>ftp://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/7.0/7.0-RELEASE-amd64-livefs.iso
>> > (the bootonly most likely will fail in the same way:
>> > 
>ftp://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/7.0/7.0-RELEASE-amd64-bootonly.iso
>> > , you can go to
>> >    http://mirrorlist.freebsd.org/
>> > to find a mirror near you, search for ISOs.)
>> 
>> Well, I finally got around looking at this again, and found the cause
>> wasn't exactly a bug, just a too low constant:
>> 
>> Index: qemu/exec-all.h
>> @@ -30,7 +30,7 @@
>>  struct TranslationBlock;
>>  
>>  /* XXX: make safe guess about sizes */
>> -#define MAX_OP_PER_INSTR 64
>> +#define MAX_OP_PER_INSTR 128
>>  /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
>>  #define MAX_OPC_PARAM 10
>>  #define OPC_BUF_SIZE 512
>> 
>>  With this I can at least boot into fixit and run find /dist (I didn't
>> test an actual install.)
>
>Were you able to isolate the offending instruction? With more than 64
>ops it should probably use a helper function.

Well, I have the backtrace of the overwrite watchpoint hit:

tcg_gen_shifti_i64 (ret=33, arg1=33, c=31, right=34, arith=0) at tcg-op.h:69
69          *gen_opparam_ptr++ = GET_TCGV(arg1);
(gdb) l
64      }
65
66      static inline void tcg_gen_op3(int opc, TCGv arg1, TCGv arg2, TCGv arg3)
67      {
68          *gen_opc_ptr++ = opc;
69          *gen_opparam_ptr++ = GET_TCGV(arg1);
70          *gen_opparam_ptr++ = GET_TCGV(arg2);
71          *gen_opparam_ptr++ = GET_TCGV(arg3);
72      }
73
(gdb) p gen_opc_ptr
$15 = (uint16_t *) 0x83c32e0
(gdb) bt
#0  tcg_gen_shifti_i64 (ret=33, arg1=33, c=31, right=34, arith=0)
    at tcg-op.h:69
#1  0x080dbc03 in gen_rot_rm_T1 (s=0xbfbfd570, ot=2, op1=12, is_right=1)
    at tcg-op.h:751
#2  0x080f924b in disas_insn (s=0xbfbfd570, pc_start=18446744071566862578)
    at 
/usr/ports/emulators/qemu-devel/work/qemu-snapshot-2008-06-20_19/target-i386/translate.c:4911
#3  0x08149ada in gen_intermediate_code (env=0x12771000, tb=0x11217a00)
    at 
/usr/ports/emulators/qemu-devel/work/qemu-snapshot-2008-06-20_19/target-i386/translate.c:7205
#4  0x080d51cb in cpu_x86_gen_code (env=0x12771000, tb=0x11217a00, 
    gen_code_size_ptr=0xbfbfd6ec)
    at 
/usr/ports/emulators/qemu-devel/work/qemu-snapshot-2008-06-20_19/translate-all.c:96
#5  0x080d5b90 in cpu_x86_exec (env1=0x83be268)
    at 
/usr/ports/emulators/qemu-devel/work/qemu-snapshot-2008-06-20_19/cpu-exec.c:141
#6  0x08056056 in main (argc=0, argv=0x0)
    at 
/usr/ports/emulators/qemu-devel/work/qemu-snapshot-2008-06-20_19/vl.c:7233

 Seeing what's at pc_start=18446744071566862578:
        0xffffffff804928f2 <MD5Transform+898>:  ror    $0x17,%r12d
(which is also the insn the mentioned in_asm log ends with.)

 But, can't there be more cases like this for amd64 targets on i386 hosts?
Since it has to do most ops in pieces...

 Thanx,
        Juergen