[Qemu-devel] powerpc hang

[Qemu-devel] powerpc hang

[Jon Nall]

[-- Attachment #1: Type: text/plain, Size: 434 bytes --]

hello.
i'm pretty new to qemu and last night set out to help debug the current
ppc hang when using gcc3. trying to understand the code has left me with
a question about how op_jmp_tb_next works on powerpc. would someone
kindly walk through what should happen? i'm speficially curious about:

- how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec()
- how the tb_jmp_offset member is ultimately used

thanks!
nall.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [Qemu-devel] powerpc hang

[Fabrice Bellard]

The branch in JUMP_TB can jump to one of two targets:

1) The next instruction which sets 'T0' to the Translation Block (TB) 
address ored with the branch index (0 or 1) and env->eip to the target 
EIP value. This is the default (and slow) case.

2) Directly to the TB corresponding to the target EIP value.

The information stored in the translation block tells where to find the 
'branch' instruction in the TB (16 bit offset from the start of the 
translated block) and which value must be stored in it to jump to the 
next instruction (another 16 bit offset).

Fabrice.

Jon Nall wrote:
> hello.
> i'm pretty new to qemu and last night set out to help debug the current
> ppc hang when using gcc3. trying to understand the code has left me with
> a question about how op_jmp_tb_next works on powerpc. would someone
> kindly walk through what should happen? i'm speficially curious about:
> 
> - how the branch in JUMP_TB gets patched if T0 == 0 in cpu_exec()
> - how the tb_jmp_offset member is ultimately used

Re: [Qemu-devel] powerpc hang

[Jon Nall]

[-- Attachment #1.1: Type: text/plain, Size: 557 bytes --]

i believe i've fixed the hang problem (see attached patch). here's
my current findings with the binaries provided with qemu and
the qemu-glibc tarball.

hello-i386 -> runs with or without the patch below
ls-i386    -> runs with the patch below, hangs without it
test-i386  -> runs with the 3 exceptions: the func_lret32 and func_iret32
              tests both die with a SIGSEGV. Also i get "Unsupported syscall:
			  252" when the program exits. i'm looking into both of these.

anyone know what changed to cause the label offsets to be off by 4?

nall.


[-- Attachment #1.2: qemu-ppc.diff --]
[-- Type: text/plain, Size: 851 bytes --]

--- dyngen.c	11 Jul 2003 15:16:56 -0000	1.26
+++ dyngen.c	7 Aug 2003 21:19:55 -0000
@@ -687,7 +687,11 @@
 
                     if (val >= start_offset && val < start_offset + copy_size) {
                         n = strtol(p, NULL, 10);
+#if ( __GNUC__ == 3) && defined(__powerpc__)
+                        fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4);
+#else
                         fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset);
+#endif
                     }
                 }
             }
--- exec.h	26 Jul 2003 12:06:08 -0000	1.13
+++ exec.h	7 Aug 2003 21:19:55 -0000
@@ -210,6 +210,7 @@
 label ## n:\
     T0 = (long)(tbparam) + (n);\
     EIP = eip;\
+    EXIT_TB();\
 } while (0)
 
 #else

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [Qemu-devel] powerpc hang

[Christof Petig]

Jon Nall schrieb:
> i believe i've fixed the hang problem (see attached patch). here's
> my current findings with the binaries provided with qemu and
> the qemu-glibc tarball.

This patch fixes my problems (besides not being able to run a more 
recent Wine without segv, but that seems to be a different story).

    Christof

Re: [Qemu-devel] powerpc hang

[Jon Nall]

On Thu, Aug 07, 2003 at 05:05:45PM -0500, Jon Nall wrote:
> test-i386  -> runs with the 3 exceptions: the func_lret32 and func_iret32
>               tests both die with a SIGSEGV. Also i get "Unsupported syscall:
> 			  252" when the program exits. i'm looking into both of these.
> 

i've found a little more information:

- Unsupported syscall: 252. grepping through kernel headers, it seems
  that i386, cris, and ppc64 are the only architectures that define a
  syscall for syscall 252 (__NR_exit_group) in linux 2.4. the 2.5 kernel
  seems to have most (all?) architectures supporting this syscall,
  although the actual number varies with architecture and syscall_defs.h
  should probably be updated with that information.

- the SIGSEGV. this occurs because there are lots of uses of
  env->regs[R_ESP] in helper-i386.c. however, on ppc, ESP is
  $r17. adding:
  env->regs[R_ESP] = ESP;
  to the top of helper_ret_protected() allowed func_lret32 and
  func_iret32 to succeed. however, the env->regs[R_ESP] usage is
  strewn all over the code.
  
  Question: is it safe to replace all of these with ESP since ESP should
  default to env->regs[R_ESP] if there is no AREG defined for the
  architecture? (or more generally, is it safe to replace env->regs[XXX]
  with XXX?)

thanks!
nall.

Re: [Qemu-devel] powerpc hang

[Jon Nall]

[-- Attachment #1.1: Type: text/plain, Size: 740 bytes --]

On Fri, Aug 08, 2003 at 08:13:35AM -0500, Jon Nall wrote:
>   Question: is it safe to replace all of these with ESP since ESP should
>   default to env->regs[R_ESP] if there is no AREG defined for the
>   architecture? (or more generally, is it safe to replace env->regs[XXX]
>   with XXX?)

i replaced all instances of env->regs[R_ESP] in helper-i386.c with ESP
(see below). this allowed me to run test-i386 to completion with no
errors! i'm attaching a full patch to get qemu working on ppc/gcc3,
which includes this change and the changes i posted previously.

NOTE: there was one instance of env->regs[E_ESP] in helper-i386.c that
went unchanged -- the one in cpu_loop_exit(), since this was setting the
register to ESP anyway.


nall.

[-- Attachment #1.2: qemu-ppc-gcc3.patch --]
[-- Type: text/plain, Size: 5848 bytes --]

--- dyngen.c	11 Jul 2003 15:16:56 -0000	1.26
+++ dyngen.c	9 Aug 2003 02:52:25 -0000
@@ -687,7 +687,11 @@
 
                     if (val >= start_offset && val < start_offset + copy_size) {
                         n = strtol(p, NULL, 10);
+#if ( __GNUC__ == 3) && defined(__powerpc__)
+                        fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4);
+#else
                         fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset);
+#endif
                     }
                 }
             }
--- exec.h	26 Jul 2003 12:06:08 -0000	1.13
+++ exec.h	9 Aug 2003 02:52:26 -0000
@@ -210,6 +210,7 @@
 label ## n:\
     T0 = (long)(tbparam) + (n);\
     EIP = eip;\
+    EXIT_TB();\
 } while (0)
 
 #else
--- helper-i386.c	29 Jul 2003 20:53:01 -0000	1.11
+++ helper-i386.c	9 Aug 2003 02:52:27 -0000
@@ -285,13 +285,13 @@
 
     /* XXX: check that enough room is available */
     if (new_stack) {
-        old_esp = env->regs[R_ESP];
+        old_esp = ESP;
         old_ss = env->segs[R_SS].selector;
         load_seg(R_SS, ss, env->eip);
     } else {
         old_esp = 0;
         old_ss = 0;
-        esp = env->regs[R_ESP];
+        esp = ESP;
     }
     if (is_int)
         old_eip = next_eip;
@@ -300,7 +300,7 @@
     old_cs = env->segs[R_CS].selector;
     load_seg(R_CS, selector, env->eip);
     env->eip = offset;
-    env->regs[R_ESP] = esp - push_size;
+    ESP = esp - push_size;
     ssp = env->segs[R_SS].base + esp;
     if (shift == 1) {
         int old_eflags;
@@ -374,7 +374,7 @@
     ptr = dt->base + intno * 4;
     offset = lduw(ptr);
     selector = lduw(ptr + 2);
-    esp = env->regs[R_ESP];
+    esp = ESP;
     ssp = env->segs[R_SS].base;
     if (is_int)
         old_eip = next_eip;
@@ -389,7 +389,7 @@
     stw(ssp + (esp & 0xffff), old_eip);
     
     /* update processor state */
-    env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);
+    ESP = (ESP & ~0xffff) | (esp & 0xffff);
     env->eip = offset;
     env->segs[R_CS].selector = selector;
     env->segs[R_CS].base = (uint8_t *)(selector << 4);
@@ -784,7 +784,7 @@
     
     new_cs = T0;
     new_eip = T1;
-    esp = env->regs[R_ESP];
+    esp = ESP;
     esp_mask = 0xffffffff;
     if (!(env->segs[R_SS].flags & DESC_B_MASK))
         esp_mask = 0xffff;
@@ -802,9 +802,9 @@
     }
 
     if (!(env->segs[R_SS].flags & DESC_B_MASK))
-        env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);
+        ESP = (ESP & ~0xffff) | (esp & 0xffff);
     else
-        env->regs[R_ESP] = esp;
+        ESP = esp;
     env->eip = new_eip;
     env->segs[R_CS].selector = new_cs;
     env->segs[R_CS].base = (uint8_t *)(new_cs << 4);
@@ -846,7 +846,7 @@
         if (!(e2 & DESC_P_MASK))
             raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
 
-        sp = env->regs[R_ESP];
+        sp = ESP;
         if (!(env->segs[R_SS].flags & DESC_B_MASK))
             sp &= 0xffff;
         ssp = env->segs[R_SS].base + sp;
@@ -868,9 +868,9 @@
             raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
         /* from this point, not restartable */
         if (!(env->segs[R_SS].flags & DESC_B_MASK))
-            env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff);
+            ESP = (ESP & 0xffff0000) | (sp & 0xffff);
         else
-            env->regs[R_ESP] = sp;
+            ESP = sp;
         env->segs[R_CS].base = sc1.base;
         env->segs[R_CS].limit = sc1.limit;
         env->segs[R_CS].flags = sc1.flags;
@@ -938,7 +938,7 @@
             param_count = e2 & 0x1f;
             push_size = ((param_count * 2) + 8) << shift;
 
-            old_esp = env->regs[R_ESP];
+            old_esp = ESP;
             old_ss = env->segs[R_SS].selector;
             if (!(env->segs[R_SS].flags & DESC_B_MASK))
                 old_esp &= 0xffff;
@@ -995,11 +995,12 @@
         load_seg(R_CS, selector, env->eip);
         /* from this point, not restartable if same priviledge */
         if (!(env->segs[R_SS].flags & DESC_B_MASK))
-            env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff);
+            ESP = (ESP & 0xffff0000) | (sp & 0xffff);
         else
-            env->regs[R_ESP] = sp;
+            ESP = sp;
         EIP = offset;
     }
+
 }
 
 /* init the segment cache in vm86 mode */
@@ -1020,7 +1021,7 @@
     uint8_t *ssp;
     int eflags_mask;
     
-    sp = env->regs[R_ESP] & 0xffff;
+    sp = ESP & 0xffff;
     ssp = env->segs[R_SS].base + sp;
     if (shift == 1) {
         /* 32 bits */
@@ -1034,7 +1035,7 @@
         new_eip = lduw(ssp);
     }
     new_esp = sp + (6 << shift);
-    env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | 
+    ESP = (ESP & 0xffff0000) | 
         (new_esp & 0xffff);
     load_seg_vm(R_CS, new_cs);
     env->eip = new_eip;
@@ -1053,7 +1054,7 @@
     int cpl, dpl, rpl, eflags_mask;
     uint8_t *ssp;
     
-    sp = env->regs[R_ESP];
+    sp = ESP;
     if (!(env->segs[R_SS].flags & DESC_B_MASK))
         sp &= 0xffff;
     ssp = env->segs[R_SS].base + sp;
@@ -1129,9 +1130,9 @@
         load_seg(R_SS, new_ss, env->eip);
     }
     if (env->segs[R_SS].flags & DESC_B_MASK)
-        env->regs[R_ESP] = new_esp;
+        ESP = new_esp;
     else
-        env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | 
+        ESP = (ESP & 0xffff0000) | 
             (new_esp & 0xffff);
     env->eip = new_eip;
     if (is_iret) {
@@ -1164,7 +1165,7 @@
     load_seg_vm(R_GS, new_gs);
 
     env->eip = new_eip;
-    env->regs[R_ESP] = new_esp;
+    ESP = new_esp;
 }
 
 void helper_iret_protected(int shift)

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [Qemu-devel] powerpc hang

[Fabrice Bellard]

It should be safe. I am going to merge your patch. Thank you!

Fabrice.

Jon Nall wrote:
> On Fri, Aug 08, 2003 at 08:13:35AM -0500, Jon Nall wrote:
> 
>>  Question: is it safe to replace all of these with ESP since ESP should
>>  default to env->regs[R_ESP] if there is no AREG defined for the
>>  architecture? (or more generally, is it safe to replace env->regs[XXX]
>>  with XXX?)
> 
> 
> i replaced all instances of env->regs[R_ESP] in helper-i386.c with ESP
> (see below). this allowed me to run test-i386 to completion with no
> errors! i'm attaching a full patch to get qemu working on ppc/gcc3,
> which includes this change and the changes i posted previously.
> 
> NOTE: there was one instance of env->regs[E_ESP] in helper-i386.c that
> went unchanged -- the one in cpu_loop_exit(), since this was setting the
> register to ESP anyway.
> 
> 
> nall.
> 
> 
> ------------------------------------------------------------------------
> 
> --- dyngen.c	11 Jul 2003 15:16:56 -0000	1.26
> +++ dyngen.c	9 Aug 2003 02:52:25 -0000
> @@ -687,7 +687,11 @@
>  
>                      if (val >= start_offset && val < start_offset + copy_size) {
>                          n = strtol(p, NULL, 10);
> +#if ( __GNUC__ == 3) && defined(__powerpc__)
> +                        fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset + 4);
> +#else
>                          fprintf(outfile, "    label_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, val - start_offset);
> +#endif
>                      }
>                  }
>              }
> --- exec.h	26 Jul 2003 12:06:08 -0000	1.13
> +++ exec.h	9 Aug 2003 02:52:26 -0000
> @@ -210,6 +210,7 @@
>  label ## n:\
>      T0 = (long)(tbparam) + (n);\
>      EIP = eip;\
> +    EXIT_TB();\
>  } while (0)
>  
>  #else
> --- helper-i386.c	29 Jul 2003 20:53:01 -0000	1.11
> +++ helper-i386.c	9 Aug 2003 02:52:27 -0000
> @@ -285,13 +285,13 @@
>  
>      /* XXX: check that enough room is available */
>      if (new_stack) {
> -        old_esp = env->regs[R_ESP];
> +        old_esp = ESP;
>          old_ss = env->segs[R_SS].selector;
>          load_seg(R_SS, ss, env->eip);
>      } else {
>          old_esp = 0;
>          old_ss = 0;
> -        esp = env->regs[R_ESP];
> +        esp = ESP;
>      }
>      if (is_int)
>          old_eip = next_eip;
> @@ -300,7 +300,7 @@
>      old_cs = env->segs[R_CS].selector;
>      load_seg(R_CS, selector, env->eip);
>      env->eip = offset;
> -    env->regs[R_ESP] = esp - push_size;
> +    ESP = esp - push_size;
>      ssp = env->segs[R_SS].base + esp;
>      if (shift == 1) {
>          int old_eflags;
> @@ -374,7 +374,7 @@
>      ptr = dt->base + intno * 4;
>      offset = lduw(ptr);
>      selector = lduw(ptr + 2);
> -    esp = env->regs[R_ESP];
> +    esp = ESP;
>      ssp = env->segs[R_SS].base;
>      if (is_int)
>          old_eip = next_eip;
> @@ -389,7 +389,7 @@
>      stw(ssp + (esp & 0xffff), old_eip);
>      
>      /* update processor state */
> -    env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);
> +    ESP = (ESP & ~0xffff) | (esp & 0xffff);
>      env->eip = offset;
>      env->segs[R_CS].selector = selector;
>      env->segs[R_CS].base = (uint8_t *)(selector << 4);
> @@ -784,7 +784,7 @@
>      
>      new_cs = T0;
>      new_eip = T1;
> -    esp = env->regs[R_ESP];
> +    esp = ESP;
>      esp_mask = 0xffffffff;
>      if (!(env->segs[R_SS].flags & DESC_B_MASK))
>          esp_mask = 0xffff;
> @@ -802,9 +802,9 @@
>      }
>  
>      if (!(env->segs[R_SS].flags & DESC_B_MASK))
> -        env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);
> +        ESP = (ESP & ~0xffff) | (esp & 0xffff);
>      else
> -        env->regs[R_ESP] = esp;
> +        ESP = esp;
>      env->eip = new_eip;
>      env->segs[R_CS].selector = new_cs;
>      env->segs[R_CS].base = (uint8_t *)(new_cs << 4);
> @@ -846,7 +846,7 @@
>          if (!(e2 & DESC_P_MASK))
>              raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
>  
> -        sp = env->regs[R_ESP];
> +        sp = ESP;
>          if (!(env->segs[R_SS].flags & DESC_B_MASK))
>              sp &= 0xffff;
>          ssp = env->segs[R_SS].base + sp;
> @@ -868,9 +868,9 @@
>              raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
>          /* from this point, not restartable */
>          if (!(env->segs[R_SS].flags & DESC_B_MASK))
> -            env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff);
> +            ESP = (ESP & 0xffff0000) | (sp & 0xffff);
>          else
> -            env->regs[R_ESP] = sp;
> +            ESP = sp;
>          env->segs[R_CS].base = sc1.base;
>          env->segs[R_CS].limit = sc1.limit;
>          env->segs[R_CS].flags = sc1.flags;
> @@ -938,7 +938,7 @@
>              param_count = e2 & 0x1f;
>              push_size = ((param_count * 2) + 8) << shift;
>  
> -            old_esp = env->regs[R_ESP];
> +            old_esp = ESP;
>              old_ss = env->segs[R_SS].selector;
>              if (!(env->segs[R_SS].flags & DESC_B_MASK))
>                  old_esp &= 0xffff;
> @@ -995,11 +995,12 @@
>          load_seg(R_CS, selector, env->eip);
>          /* from this point, not restartable if same priviledge */
>          if (!(env->segs[R_SS].flags & DESC_B_MASK))
> -            env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | (sp & 0xffff);
> +            ESP = (ESP & 0xffff0000) | (sp & 0xffff);
>          else
> -            env->regs[R_ESP] = sp;
> +            ESP = sp;
>          EIP = offset;
>      }
> +
>  }
>  
>  /* init the segment cache in vm86 mode */
> @@ -1020,7 +1021,7 @@
>      uint8_t *ssp;
>      int eflags_mask;
>      
> -    sp = env->regs[R_ESP] & 0xffff;
> +    sp = ESP & 0xffff;
>      ssp = env->segs[R_SS].base + sp;
>      if (shift == 1) {
>          /* 32 bits */
> @@ -1034,7 +1035,7 @@
>          new_eip = lduw(ssp);
>      }
>      new_esp = sp + (6 << shift);
> -    env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | 
> +    ESP = (ESP & 0xffff0000) | 
>          (new_esp & 0xffff);
>      load_seg_vm(R_CS, new_cs);
>      env->eip = new_eip;
> @@ -1053,7 +1054,7 @@
>      int cpl, dpl, rpl, eflags_mask;
>      uint8_t *ssp;
>      
> -    sp = env->regs[R_ESP];
> +    sp = ESP;
>      if (!(env->segs[R_SS].flags & DESC_B_MASK))
>          sp &= 0xffff;
>      ssp = env->segs[R_SS].base + sp;
> @@ -1129,9 +1130,9 @@
>          load_seg(R_SS, new_ss, env->eip);
>      }
>      if (env->segs[R_SS].flags & DESC_B_MASK)
> -        env->regs[R_ESP] = new_esp;
> +        ESP = new_esp;
>      else
> -        env->regs[R_ESP] = (env->regs[R_ESP] & 0xffff0000) | 
> +        ESP = (ESP & 0xffff0000) | 
>              (new_esp & 0xffff);
>      env->eip = new_eip;
>      if (is_iret) {
> @@ -1164,7 +1165,7 @@
>      load_seg_vm(R_GS, new_gs);
>  
>      env->eip = new_eip;
> -    env->regs[R_ESP] = new_esp;
> +    ESP = new_esp;
>  }
>  
>  void helper_iret_protected(int shift)
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Qemu-devel mailing list
> Qemu-devel@nongnu.org
> http://mail.nongnu.org/mailman/listinfo/qemu-devel


-- 
Fabrice.