Re: [RFC PATCH-for-5.0?] target/mips/translate: Report exception in delay slot as UNPREDICTABLE

["Philippe Mathieu-Daudé" <philmd@redhat.com>]

On 4/7/20 1:54 AM, Philippe Mathieu-Daudé wrote:
> Using the BC1ANY4F instruction with a 24Kf core (MIPS32R2
> & ASE_MIPS16) we get:
> 
>    $ echo -ne '\x03\x20\xf8\x09EEEE' > cop1x.bin
>    $ qemu-system-mipsel -bios cop1x.bin
>    unknown branch 0x13000
>    Aborted (core dumped)
> 
>    (gdb) bt
>    #0  0x00007fe2d38b1e35 in raise () at /lib64/libc.so.6
>    #1  0x00007fe2d389c895 in abort () at /lib64/libc.so.6
>    #2  0x000055aa9fe066e5 in gen_branch (ctx=0x7fe27bdfa590, insn_bytes=4) at target/mips/translate.c:13167
>    #3  0x000055aa9fe2baf4 in mips_tr_translate_insn (dcbase=0x7fe27bdfa590, cs=0x55aaa0e2d530) at target/mips/translate.c:30928
>    #4  0x000055aa9fd40138 in translator_loop (ops=0x55aaa05e94e0 <mips_tr_ops>, db=0x7fe27bdfa590, cpu=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at accel/tcg/translator.c:102
>    #5  0x000055aa9fe2bd21 in gen_intermediate_code (cs=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at target/mips/translate.c:30999
>    #6  0x000055aa9fd3e3d4 in tb_gen_code (cpu=0x55aaa0e2d530, pc=3217031168, cs_base=0, flags=268435600, cflags=-16252928) at accel/tcg/translate-all.c:1718
>    #7  0x000055aa9fd3ac06 in tb_find (cpu=0x55aaa0e2d530, last_tb=0x0, tb_exit=0, cf_mask=524288) at accel/tcg/cpu-exec.c:407
>    #8  0x000055aa9fd3b4d5 in cpu_exec (cpu=0x55aaa0e2d530) at accel/tcg/cpu-exec.c:731
>    #9  0x000055aa9fcfe33a in tcg_cpu_exec (cpu=0x55aaa0e2d530) at cpus.c:1405
>    #10 0x000055aa9fcfeb90 in qemu_tcg_cpu_thread_fn (arg=0x55aaa0e2d530) at cpus.c:1713
>    #11 0x000055aaa02ea7d7 in qemu_thread_start (args=0x55aaa0e465f0) at util/qemu-thread-posix.c:519
>    #12 0x00007fe2d3a484c0 in start_thread () at /lib64/libpthread.so.0
>    #13 0x00007fe2d3976163 in clone () at /lib64/libc.so.6
> 
> This is because this COP1X instruction generates a Reserved
> Instruction when used with this core, however we are in a delay
> slot, and exceptions in delay slot are architecturally unpredictable.
> 
> Core dumps confunse users. Instead, report a friendlier error message:
> 
>    $ qemu-system-mipsel -bios cop1x.bin
>    qemu-system-mipsel: Exception in delay slot is UNPREDICTABLE
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1663287
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>   target/mips/translate.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/target/mips/translate.c b/target/mips/translate.c
> index 25b595a17d..99e675b87a 100644
> --- a/target/mips/translate.c
> +++ b/target/mips/translate.c
> @@ -30925,6 +30925,10 @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
>           }
>       }
>       if (is_slot) {
> +        if (ctx->base.is_jmp == DISAS_NORETURN) {
> +            error_report("Exception in delay slot is UNPREDICTABLE");

"Exception/branch" actually.

> +            exit(1);
> +        }
>           gen_branch(ctx, insn_bytes);
>       }
>       ctx->base.pc_next += insn_bytes;
>