qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
To: qemu-devel@nongnu.org
Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	"Aleksandar Markovic" <aleksandar.qemu.devel@gmail.com>,
	"Emilio G . Cota" <cota@braap.org>,
	"Brian Campbell" <bacam@z273.org.uk>,
	"Aleksandar Rikalo" <aleksandar.rikalo@rt-rk.com>,
	"Alex Bennée" <alex.bennee@linaro.org>,
	"Aurelien Jarno" <aurelien@aurel32.net>,
	"Richard Henderson" <rth@twiddle.net>
Subject: [RFC PATCH-for-5.0?] target/mips/translate: Report exception in delay slot as UNPREDICTABLE
Date: Tue,  7 Apr 2020 01:54:18 +0200	[thread overview]
Message-ID: <20200406235418.18315-1-f4bug@amsat.org> (raw)

Using the BC1ANY4F instruction with a 24Kf core (MIPS32R2
& ASE_MIPS16) we get:

  $ echo -ne '\x03\x20\xf8\x09EEEE' > cop1x.bin
  $ qemu-system-mipsel -bios cop1x.bin
  unknown branch 0x13000
  Aborted (core dumped)

  (gdb) bt
  #0  0x00007fe2d38b1e35 in raise () at /lib64/libc.so.6
  #1  0x00007fe2d389c895 in abort () at /lib64/libc.so.6
  #2  0x000055aa9fe066e5 in gen_branch (ctx=0x7fe27bdfa590, insn_bytes=4) at target/mips/translate.c:13167
  #3  0x000055aa9fe2baf4 in mips_tr_translate_insn (dcbase=0x7fe27bdfa590, cs=0x55aaa0e2d530) at target/mips/translate.c:30928
  #4  0x000055aa9fd40138 in translator_loop (ops=0x55aaa05e94e0 <mips_tr_ops>, db=0x7fe27bdfa590, cpu=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at accel/tcg/translator.c:102
  #5  0x000055aa9fe2bd21 in gen_intermediate_code (cs=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at target/mips/translate.c:30999
  #6  0x000055aa9fd3e3d4 in tb_gen_code (cpu=0x55aaa0e2d530, pc=3217031168, cs_base=0, flags=268435600, cflags=-16252928) at accel/tcg/translate-all.c:1718
  #7  0x000055aa9fd3ac06 in tb_find (cpu=0x55aaa0e2d530, last_tb=0x0, tb_exit=0, cf_mask=524288) at accel/tcg/cpu-exec.c:407
  #8  0x000055aa9fd3b4d5 in cpu_exec (cpu=0x55aaa0e2d530) at accel/tcg/cpu-exec.c:731
  #9  0x000055aa9fcfe33a in tcg_cpu_exec (cpu=0x55aaa0e2d530) at cpus.c:1405
  #10 0x000055aa9fcfeb90 in qemu_tcg_cpu_thread_fn (arg=0x55aaa0e2d530) at cpus.c:1713
  #11 0x000055aaa02ea7d7 in qemu_thread_start (args=0x55aaa0e465f0) at util/qemu-thread-posix.c:519
  #12 0x00007fe2d3a484c0 in start_thread () at /lib64/libpthread.so.0
  #13 0x00007fe2d3976163 in clone () at /lib64/libc.so.6

This is because this COP1X instruction generates a Reserved
Instruction when used with this core, however we are in a delay
slot, and exceptions in delay slot are architecturally unpredictable.

Core dumps confunse users. Instead, report a friendlier error message:

  $ qemu-system-mipsel -bios cop1x.bin
  qemu-system-mipsel: Exception in delay slot is UNPREDICTABLE

Buglink: https://bugs.launchpad.net/qemu/+bug/1663287
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/mips/translate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/mips/translate.c b/target/mips/translate.c
index 25b595a17d..99e675b87a 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -30925,6 +30925,10 @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
         }
     }
     if (is_slot) {
+        if (ctx->base.is_jmp == DISAS_NORETURN) {
+            error_report("Exception in delay slot is UNPREDICTABLE");
+            exit(1);
+        }
         gen_branch(ctx, insn_bytes);
     }
     ctx->base.pc_next += insn_bytes;
-- 
2.21.1



             reply	other threads:[~2020-04-06 23:55 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-06 23:54 Philippe Mathieu-Daudé [this message]
2020-04-06 23:57 ` [RFC PATCH-for-5.0?] target/mips/translate: Report exception in delay slot as UNPREDICTABLE Philippe Mathieu-Daudé
2020-04-07  8:35 ` Peter Maydell
2020-04-07  9:23   ` Philippe Mathieu-Daudé
2020-04-07  9:32     ` Philippe Mathieu-Daudé
2020-04-07 21:35       ` Aleksandar Markovic

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200406235418.18315-1-f4bug@amsat.org \
    --to=f4bug@amsat.org \
    --cc=aleksandar.qemu.devel@gmail.com \
    --cc=aleksandar.rikalo@rt-rk.com \
    --cc=alex.bennee@linaro.org \
    --cc=aurelien@aurel32.net \
    --cc=bacam@z273.org.uk \
    --cc=cota@braap.org \
    --cc=qemu-devel@nongnu.org \
    --cc=rth@twiddle.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).