Re: [Qemu-devel] Crash due to invalid env->current_tb

[Blue Swirl]

On 5/1/08, Adam Lackorzynski <address@hidden> wrote:
>
>  On Wed Apr 30, 2008 at 21:21:40 +0300, Blue Swirl wrote:
>  > The attached version survives quick tests for both Sparc32 and Sparc64.
>
>
> Ok, I did not check for 64bit targets. So what about the following,
>  works for me for arm, x86-32 and x86-64.
>
>
>  Index: cpu-exec.c
>  ===================================================================
>  --- cpu-exec.c  (revision 4276)
>  +++ cpu-exec.c  (working copy)
>
> @@ -690,7 +691,22 @@
>
>                 fp.ip = tc_ptr;
>                 fp.gp = code_gen_buffer + 2 * (1 << 20);
>                 (*(void (*)(void)) &fp)();
>  +#elif defined(__i386)
>
> +#if (TARGET_LONG_BITS == 32)
>  +#define CLOBBER ,"edx"
>   #else
>  +#define CLOBBER ,"ebx"
>  +#endif
>  +               asm volatile ("push %%ebp\n"
>  +                             "call *%1\n"
>  +                             "pop %%ebp\n"
>  +                             : "=A" (T0)
>  +                             : "a" (gen_func)
>  +                             : "ecx", "esi", "edi", "cc" CLOBBER
>  +                             );
>  +               T0 &= 0xffffffff;
>  +#undef CLOBBER
>  +#else
>                  T0 = gen_func();
>   #endif
>                  env->current_tb = NULL;
>
>
>  For 64bit target T0 is 64bits so "=a" does not work and "=A" is needed.
>  The strange thing is that I need to throw away the upper 32bits because
>  otherwise it won't work. gen_func is defined to return just long but T0
>  is unsigned long long, this seems inconsistent. The 'and' does not
>  appear in 32bit targets so it does not harm there.

This is because in this special case, T0 is not used as target CPU
temporary, but instead to return next TB address. On i386 this is 32
bits, so only EAX is needed. TCG does not touch EDX, so it contains
garbage. This also means that moving EDX to high word of T0 and then
throwing the high word away may be slightly wasteful.