Re: [Qemu-devel] Re: strange crash on FreeBSD-current/amd64 (pointer truncation?)

[Juergen Lock]

On Fri, Feb 02, 2007 at 04:02:00AM +0000, Thiemo Seufer wrote:
> Juergen Lock wrote:
> > On Wed, Jan 24, 2007 at 09:00:19PM +0100, Juergen Lock wrote:
> > > Hi!
> > > 
> > >  I got a report of qemu segfaulting here on FreeBSD-current/amd64:
> > > 
> > > > #0  main_loop () at 
> > > > /usr/ports-cvs/emulators/qemu/work/qemu-snapshot-2007-01-11_05/vl.c:6125
> > > > 6125                    env = env->next_cpu;
> > > > [New Thread 0x801e10190 (LWP 100214)]
> > > > (gdb) print env
> > > > $1 = (CPUX86State *) 0xac10000
> > > > (gdb) print first_cpu
> > > > $2 = (CPUX86State *) 0x80ac10000
> > 
> > Ok Jung-uk Kim found the following fix: (Thanx!)
> > 
> > --- qemu/cpu-exec.c.orig    Wed Jan 31 16:58:03 2007
> > +++ qemu/cpu-exec.c Wed Jan 31 17:08:11 2007
> > @@ -226,9 +226,9 @@
> >  
> >  int cpu_exec(CPUState *env1)
> >  {
> > -    int saved_T0, saved_T1;
> > +    long saved_T0, saved_T1;
> >  #if defined(reg_T2)
> > -    int saved_T2;
> > +    long saved_T2;
> 
> I used target_ulong instead.

Isn't that 32 bit for 32 bit targets?  Then it wouldn't fix the bug,
the problem happened for 32 bit guests (i386-softmmu) on 64 bit hosts
(FreeBSD-current/amd64), there the upper half of rbx which held a
pointer in the calling function was lost...

        Juergen