On Wed, Sep 19, 2012 at 11:53 PM, Richard Henderson <r...@twiddle.net> wrote:
> On 09/19/2012 11:30 AM, Peter Maydell wrote:
>> ...but on the other hand that ought to work for PPC too, so
>> presumably my analysis is wrong somewhere.
>
> It isn't. It's a target-xtensa bug.
>
>> OP:
>> ---- 0xd0079cff
>> movi_i32 tmp0,$0xd0079cff
>> movi_i32 tmp1,$0x2
>> movi_i32 tmp2,$0x1
>> movi_i32 tmp3,$advance_ccount
>> call tmp3,$0x0,$0,env,tmp2
>> movi_i32 tmp2,$window_check
>> call tmp2,$0x0,$0,env,tmp0,tmp1
>> and_i32 tmp0,ar9,ar8
>> movi_i32 tmp1,$0x0
>> brcond_i32 tmp0,tmp1,eq,$0x0
>> movi_i32 tmp2,$0x0
>> brcond_i32 LCOUNT,tmp2,eq,$0x1
>> movi_i32 tmp2,$0x1
>> sub_i32 LCOUNT,LCOUNT,tmp2
>> movi_i32 tmp2,$0xd0079cf2
>> mov_i32 pc,tmp2
>> goto_tb $0x0
>> exit_tb $0x4a116558
>> set_label $0x1
>> movi_i32 tmp2,$0xd0079d02
>> mov_i32 pc,tmp2
>> exit_tb $0x0
>> set_label $0x0
>> movi_i32 tmp2,$0xd0079d1a
>> mov_i32 pc,tmp2
>> goto_tb $0x1
>> exit_tb $0x4a116559
>> movi_i32 tmp0,$0x0
>> brcond_i32 LCOUNT,tmp0,eq,$0x2
>> movi_i32 tmp0,$0x1
>> sub_i32 LCOUNT,LCOUNT,tmp0
>> movi_i32 tmp0,$0xd0079cf2
>> mov_i32 pc,tmp0
>> goto_tb $0x0
>> exit_tb $0x4a116558
>> set_label $0x2
>> movi_i32 tmp0,$0xd0079d02
>> mov_i32 pc,tmp0
>> exit_tb $0x0
>
> There are two instances of goto_tb $0 in here.
> And, amusingly, two checks for LCOUNT.
>
> Since there's no disassembler for xtensa, I'll
> leave it to the maintainer to track down from
> whence this mistake stems.
This code is generated when TB ends on LEND
(zero-overhead loop ending) with branching instruction.
So, in addition to 3 way branch there's extra looping code
generated by unconditional gen_check_loop_end(dc, 0);
at the end of disas_xtensa_insn. I was pretty sure that this
dead code would make no harm. --enable-debug-tcg says
nothing on x86_64 host. The following should fix that:
-- >8 --
From: Max Filippov <jcmvb...@gmail.com>
Date: Thu, 20 Sep 2012 04:07:20 +0400
Subject: [PATCH] target-xtensa: don't emit extra gen_check_loop_end
Unconditional gen_check_loop_end at the end of disas_xtensa_insn
can emit tcg_gen_goto_tb with slot id already used in the TB (e.g. when
TB ends at LEND with a branch). Not all tcg backends can handle that.
Signed-off-by: Max Filippov <jcmvb...@gmail.com>
---
target-xtensa/translate.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index 63b37b3..57a2b6f 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2502,7 +2502,9 @@ static void disas_xtensa_insn(DisasContext *dc)
break;
}
- gen_check_loop_end(dc, 0);
+ if (dc->is_jmp == DISAS_NEXT) {
+ gen_check_loop_end(dc, 0);
+ }
dc->pc = dc->next_pc;
return;
--
1.7.7.6
