[Qemu-devel] tcg/tcg.c:1892: tcg fatal error

[Artyom Tarasenko]

Trying to boot some proprietary OS I get qemu-system-sparc64 crash with a

tcg/tcg.c:1892: tcg fatal error

error message.

It looks like it can be a platform independent bug though, because
when a '-singlestep' option IS present, qemu doesn't crash and seems
to translate the code properly.

(gdb) bt
#0  0x00000032c2e327f5 in raise () from /lib64/libc.so.6
#1  0x00000032c2e33fd5 in abort () from /lib64/libc.so.6
#2  0x000000000051933d in tcg_reg_alloc_call (s=<value optimized out>,
def=0x89d340, opc=INDEX_op_call, args=0x10acc98, dead_iargs=3) at
qemu/tcg/tcg.c:1892
#3  0x000000000051a557 in tcg_gen_code_common (s=0x10b8940,
gen_code_buf=0x40338b60 "address@hidden 3\355I\211\256\220") at
qemu/tcg/tcg.c:2099
#4  tcg_gen_code (s=0x10b8940, gen_code_buf=0x40338b60 "address@hidden
3\355I\211\256\220") at qemu/tcg/tcg.c:2142
#5  0x00000000004d38f1 in cpu_sparc_gen_code (env=0x10cce10,
tb=0x7fffe91bc218, gen_code_size_ptr=0x7fffffffd9b4) at
qemu/translate-all.c:93
#6  0x00000000004d1fd7 in tb_gen_code (env=0x10cce10, pc=18868776,
cs_base=18868780, flags=15, cflags=0) at qemu/exec.c:989
#7  0x00000000004d4029 in tb_find_slow (env1=<value optimized out>) at
qemu/cpu-exec.c:167
#8  tb_find_fast (env1=<value optimized out>) at cpu-exec.c:194
#9  cpu_sparc_exec (env1=<value optimized out>) at qemu/cpu-exec.c:556
#10 0x0000000000408868 in tcg_cpu_exec () at qemu/cpus.c:1066
#11 cpu_exec_all () at qemu/cpus.c:1102
#12 0x000000000053c756 in main_loop (argc=<value optimized out>,
argv=<value optimized out>, envp=<value optimized out>) at
qemu/vl.c:1430

I inspected ts->val_type causing the abort() case and it turned out to be 0.

The last lines of qemu.log (without -singlestep)
IN:
0x00000000011fe9f0:  rdpr  %pstate, %g1
0x00000000011fe9f4:  wrpr  %g1, 2, %pstate
--------------
IN:
0x00000000011fe9f8:  ldub  [ %o0 ], %o1
0x00000000011fe9fc:  mov  %o1, %o2
0x00000000011fea00:  rdpr  %tick, %o3
0x00000000011fea04:  cmp  %o1, %o2
0x00000000011fea08:  be  %icc, 0x11fea00
0x00000000011fea0c:  ldub  [ %o0 ], %o2

Search PC...
Search PC...
Search PC...
Search PC...
Search PC...
Search PC...
--------------
IN:
0x00000000011fe9f8:  ldub  [ %o0 ], %o1
0x00000000011fe9fc:  mov  %o1, %o2
0x00000000011fea00:  rdpr  %tick, %o3
0x00000000011fea04:  cmp  %o1, %o2
0x00000000011fea08:  be  %icc, 0x11fea00
0x00000000011fea0c:  ldub  [ %o0 ], %o2

110521: Data Access MMU Miss (v=0068) pc=00000000011fe9f8
npc=00000000011fe9fc SP=000000000180ae41
pc: 00000000011fe9f8  npc: 00000000011fe9fc

IN:
0x00000000011fea00:  rdpr  %tick, %o3
0x00000000011fea04:  cmp  %o1, %o2
0x00000000011fea08:  be  %icc, 0x11fea00
0x00000000011fea0c:  ldub  [ %o0 ], %o2
--------------
IN:
0x00000000011fea10:  brz,pn   %o2, 0x11fe9f8
0x00000000011fea14:  mov  %o2, %o4
--------------
IN:
0x00000000011fea18:  rdpr  %tick, %o5
0x00000000011fea1c:  cmp  %o2, %o4
0x00000000011fea20:  be  %icc, 0x11fea18
0x00000000011fea24:  ldub  [ %o0 ], %o4
--------------
IN:
0x00000000011fea28:  brz,pn   %o4, 0x11fe9f4
0x00000000011fea2c:  wrpr  %g0, %g1, %pstate
<EOF>

The crash is 100% reproducible and happens always on the same place,
so it's probably a pure TCG issue, not related on getting the
external/timer interrupts.

Do you need any additional info?

-- 
Regards,
Artyom Tarasenko

solaris/sparc under qemu blog: http://tyom.blogspot.com/