From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1HSXFh-0003HY-5l for qemu-devel@nongnu.org; Sat, 17 Mar 2007 07:39:13 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1HSXFe-0003HM-P7 for qemu-devel@nongnu.org; Sat, 17 Mar 2007 07:39:11 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HSXFe-0003HJ-Ia for qemu-devel@nongnu.org; Sat, 17 Mar 2007 06:39:10 -0500 Received: from moutng.kundenserver.de ([212.227.126.187]) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1HSXEQ-0004OG-BZ for qemu-devel@nongnu.org; Sat, 17 Mar 2007 07:37:54 -0400 Message-ID: <45FBD30D.6070403@mail.berlios.de> Date: Sat, 17 Mar 2007 12:37:49 +0100 From: Stefan Weil MIME-Version: 1.0 Subject: Re: [Qemu-devel] [Bug] MIPS code fails at branch instruction References: <45FB245C.2010900@mail.berlios.de> <20070317004628.GE25863@networkno.de> In-Reply-To: <20070317004628.GE25863@networkno.de> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Thiemo Seufer , QEMU Developers So an emulation has several options: 1. Show undefined behaviour (this is what it does today). 2. Emulate the behaviour of existing CPUs as far as possible. As different CPUs behave different, this must depend on the current CPU. 3. Display an error message. The current solution (1) is not good, because users get crashes and don't know the reason, and experienced users spend a lot of time with debugging (at least I did). Solution (2) is needed to run existing binary code. Solution (3) is the minimum I expect of an emulation like QEMU. I prefer a mix of solutions (2) and (3): display a message and try to emulate the original behaviour. Do you agree, and would you accept patches which implement this? Stefan PS. Emulation of undefined instructions / undefined behaviour has a long tradition. In the old Z80 and 8086 days, it was something like a game to analyse and use them :-) Thiemo Seufer schrieb: > Stefan Weil wrote: >> QEMU MIPS emulation fails with code using "illegal" commands >> in the delay slot of a branch. >> >> I had an endless loop with QEMU running the firmware of a >> MIPS based router. >> >> MIPS says: branches, jumps, ... instructions should not be >> placed in the delay slot of a branch or jump. >> >> Nevertheless, some routers use this kind of code. > > The architecture spec defines this as undefined behaviour. Other > implementations of MIPS CPUs show funny effects which are hard > to explain without detailed knowledge of the microarchitecture. > >> I wrote a test program to examine the difference between emulation >> and a real MIPS CPU (see appendices). > > I wouldn't be surprised if it starts to fail for some other combinations > like a mix of branch and branch likely instructions. > > (The semantics of a branch delay slot are: The instruction in the delay > slot is executed, then the branch is executed. Now, when the instruction > in the delay slot is itself a branch, what will happen to its delay slot?) > > > Thiemo >