From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1HSN7P-0002wL-8a
	for qemu-devel@nongnu.org; Fri, 16 Mar 2007 20:49:59 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1HSN7M-0002tF-Tb
	for qemu-devel@nongnu.org; Fri, 16 Mar 2007 20:49:58 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1HSN7M-0002tB-LX
	for qemu-devel@nongnu.org; Fri, 16 Mar 2007 19:49:56 -0500
Received: from phoenix.bawue.net ([193.7.176.60] helo=mail.bawue.net)
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <ths@networkno.de>) id 1HSN6B-00088p-Ny
	for qemu-devel@nongnu.org; Fri, 16 Mar 2007 20:48:43 -0400
Date: Sat, 17 Mar 2007 00:46:28 +0000
Subject: Re: [Qemu-devel] [Bug] MIPS code fails at branch instruction
Message-ID: <20070317004628.GE25863@networkno.de>
References: <45FB245C.2010900@mail.berlios.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45FB245C.2010900@mail.berlios.de>
From: Thiemo Seufer <ths@networkno.de>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Weil <weil@mail.berlios.de>
Cc: QEMU Developers <qemu-devel@nongnu.org>

Stefan Weil wrote:
> Hi,
> 
> QEMU MIPS emulation fails with code using "illegal" commands
> in the delay slot of a branch.
> 
> I had an endless loop with QEMU running the firmware of a
> MIPS based router.
> 
> MIPS says: branches, jumps, ... instructions should not be
> placed in the delay slot of a branch or jump.
> 
> Nevertheless, some routers use this kind of code.

The architecture spec defines this as undefined behaviour. Other
implementations of MIPS CPUs show funny effects which are hard
to explain without detailed knowledge of the microarchitecture.

> I wrote a test program to examine the difference between emulation
> and a real MIPS CPU (see appendices).

I wouldn't be surprised if it starts to fail for some other combinations
like a mix of branch and branch likely instructions.

(The semantics of a branch delay slot are: The instruction in the delay
slot is executed, then the branch is executed. Now, when the instruction
in the delay slot is itself a branch, what will happen to its delay slot?)


Thiemo