tb_gen_code() assumes that tb->size must never be zero, otherwise it may produce spurious exceptions. For xtensa this may happen when decoding an unknown instruction, when handling a write into the CCOUNT or CCOMPARE special register and when single-stepping the first instruction of an exception handler.
Fix by pretending that the size of the respective translation block is 1 in all these cases. Signed-off-by: Ilya Leoshkevich <i...@linux.ibm.com> --- target/xtensa/translate.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c index 0ae4efc48a..73584d9d60 100644 --- a/target/xtensa/translate.c +++ b/target/xtensa/translate.c @@ -917,6 +917,7 @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc) "unknown instruction length (pc = %08x)\n", dc->pc); gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE); + dc->base.pc_next = dc->pc + 1; return; } @@ -1274,11 +1275,13 @@ static void xtensa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT) && (dc->base.tb->flags & XTENSA_TBFLAG_YIELD)) { gen_exception(dc, EXCP_YIELD); + dc->base.pc_next = dc->pc + 1; dc->base.is_jmp = DISAS_NORETURN; return; } if (dc->base.tb->flags & XTENSA_TBFLAG_EXCEPTION) { gen_exception(dc, EXCP_DEBUG); + dc->base.pc_next = dc->pc + 1; dc->base.is_jmp = DISAS_NORETURN; return; } -- 2.29.2