On 01/05/2017 03:57, Michael Eager wrote: > > > I'm seeing incorrect values when there is a write to a memory-mapped I/O > device when icount is set. What I see happening is that a TB with ~20 > instructions is executed which contains a write to the MM I/O address. > When it gets to the io_write routine, can_do_io is false, which results > in a call to cpu_io_recompile. > > cpu_io_recompile does what it (sort of) says it is supposed to do: it > builds a new TB with the I/O instruction as the last instruction in the > block, then re-issues the TB. The problem is that the new TB contains > the instructions before the I/O instruction, so they are executed a > second time.
They shouldn't. When called from cpu_io_recompile, cpu_restore_state_from_tb should compute the I/O instruction's target PC from the host PC (stored in retaddr). Then what happens is the following: - cpu_io_recompile generates a new TB ending with the I/O instruction. This new TB has a hash table conflict with the old TB (same PC/cs_base/flags) the old TB is implicitly removed - cpu_io_recompile calls cpu_loop_exit_noexc, which goes back to the execution loop with updated PC - because the PC is different, a new TB is looked up for the I/O instruction's PC. The TB probably is not there and translation starts again, this time at the I/O instruction - the new TB, when executed, causes cpu_io_recompile to fire again. This is the inefficient part mentioned in cpu_io_recompile - cpu_io_recompile now compiles a one-instruction TB and goes back to the execution loop - finally the execution loop executes the one-instruction TB for the I/O instruction, then it can go on Thanks, Paolo
