From: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
To: qemu-devel@nongnu.org
Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org>,
"Aleksandar Markovic" <aleksandar.qemu.devel@gmail.com>,
"Emilio G . Cota" <cota@braap.org>,
"Brian Campbell" <bacam@z273.org.uk>,
"Aleksandar Rikalo" <aleksandar.rikalo@rt-rk.com>,
"Alex Bennée" <alex.bennee@linaro.org>,
"Aurelien Jarno" <aurelien@aurel32.net>,
"Richard Henderson" <rth@twiddle.net>
Subject: [RFC PATCH-for-5.0?] target/mips/translate: Report exception in delay slot as UNPREDICTABLE
Date: Tue, 7 Apr 2020 01:54:18 +0200 [thread overview]
Message-ID: <20200406235418.18315-1-f4bug@amsat.org> (raw)
Using the BC1ANY4F instruction with a 24Kf core (MIPS32R2
& ASE_MIPS16) we get:
$ echo -ne '\x03\x20\xf8\x09EEEE' > cop1x.bin
$ qemu-system-mipsel -bios cop1x.bin
unknown branch 0x13000
Aborted (core dumped)
(gdb) bt
#0 0x00007fe2d38b1e35 in raise () at /lib64/libc.so.6
#1 0x00007fe2d389c895 in abort () at /lib64/libc.so.6
#2 0x000055aa9fe066e5 in gen_branch (ctx=0x7fe27bdfa590, insn_bytes=4) at target/mips/translate.c:13167
#3 0x000055aa9fe2baf4 in mips_tr_translate_insn (dcbase=0x7fe27bdfa590, cs=0x55aaa0e2d530) at target/mips/translate.c:30928
#4 0x000055aa9fd40138 in translator_loop (ops=0x55aaa05e94e0 <mips_tr_ops>, db=0x7fe27bdfa590, cpu=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at accel/tcg/translator.c:102
#5 0x000055aa9fe2bd21 in gen_intermediate_code (cs=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at target/mips/translate.c:30999
#6 0x000055aa9fd3e3d4 in tb_gen_code (cpu=0x55aaa0e2d530, pc=3217031168, cs_base=0, flags=268435600, cflags=-16252928) at accel/tcg/translate-all.c:1718
#7 0x000055aa9fd3ac06 in tb_find (cpu=0x55aaa0e2d530, last_tb=0x0, tb_exit=0, cf_mask=524288) at accel/tcg/cpu-exec.c:407
#8 0x000055aa9fd3b4d5 in cpu_exec (cpu=0x55aaa0e2d530) at accel/tcg/cpu-exec.c:731
#9 0x000055aa9fcfe33a in tcg_cpu_exec (cpu=0x55aaa0e2d530) at cpus.c:1405
#10 0x000055aa9fcfeb90 in qemu_tcg_cpu_thread_fn (arg=0x55aaa0e2d530) at cpus.c:1713
#11 0x000055aaa02ea7d7 in qemu_thread_start (args=0x55aaa0e465f0) at util/qemu-thread-posix.c:519
#12 0x00007fe2d3a484c0 in start_thread () at /lib64/libpthread.so.0
#13 0x00007fe2d3976163 in clone () at /lib64/libc.so.6
This is because this COP1X instruction generates a Reserved
Instruction when used with this core, however we are in a delay
slot, and exceptions in delay slot are architecturally unpredictable.
Core dumps confunse users. Instead, report a friendlier error message:
$ qemu-system-mipsel -bios cop1x.bin
qemu-system-mipsel: Exception in delay slot is UNPREDICTABLE
Buglink: https://bugs.launchpad.net/qemu/+bug/1663287
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
target/mips/translate.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/target/mips/translate.c b/target/mips/translate.c
index 25b595a17d..99e675b87a 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -30925,6 +30925,10 @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
}
}
if (is_slot) {
+ if (ctx->base.is_jmp == DISAS_NORETURN) {
+ error_report("Exception in delay slot is UNPREDICTABLE");
+ exit(1);
+ }
gen_branch(ctx, insn_bytes);
}
ctx->base.pc_next += insn_bytes;
--
2.21.1
next reply other threads:[~2020-04-06 23:55 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-06 23:54 Philippe Mathieu-Daudé [this message]
2020-04-06 23:57 ` [RFC PATCH-for-5.0?] target/mips/translate: Report exception in delay slot as UNPREDICTABLE Philippe Mathieu-Daudé
2020-04-07 8:35 ` Peter Maydell
2020-04-07 9:23 ` Philippe Mathieu-Daudé
2020-04-07 9:32 ` Philippe Mathieu-Daudé
2020-04-07 21:35 ` Aleksandar Markovic
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200406235418.18315-1-f4bug@amsat.org \
--to=f4bug@amsat.org \
--cc=aleksandar.qemu.devel@gmail.com \
--cc=aleksandar.rikalo@rt-rk.com \
--cc=alex.bennee@linaro.org \
--cc=aurelien@aurel32.net \
--cc=bacam@z273.org.uk \
--cc=cota@braap.org \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).