Why on earth is this code giving me Segfaults?

Why on earth is this code giving me Segfaults?

[Libo Zhou]

Hi All,

I have a custom ISA that's based on MIPS. The LW and SW instructions' opcodes are changed into 0x17(OPC_BGTZL) and 0x1F(OPC_SPECIAL3).

I have made the following changes in target/mips/translate.c:

@@ -29331,7 +29331,11 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
             decode_opc_special3(env, ctx);
         }
 #else
-        decode_opc_special3(env, ctx);
+        if (ctx->insn_flags & INSN_MYISA) {
+            gen_st(ctx, OPC_SW, rt, rs, imm); /* OPC_MYISA_SW */
+        } else {
+            decode_opc_special3(env, ctx);
+        }
 #endif
         break;
     case OPC_REGIMM:
@@ -29589,6 +29603,8 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
             }
             /* OPC_BGTZC, OPC_BLTZC, OPC_BLTC */
             gen_compute_compact_branch(ctx, op, rs, rt, imm << 2);
+        } else if (ctx->insn_flags & INSN_MYISA) {
+            gen_ld(ctx, OPC_LW, rt, rs, imm); /* OPC_MYISA_LW */
         } else {
             /* OPC_BGTZL */
             gen_compute_branch(ctx, op, 4, rs, rt, imm << 2, 4);

I used gdbstub to singlestep my program, and I found that my sw instruction is working fine, but lw gives me a segfault. I have been stuck on this for a long while, since it looks like I only need to add that one line of gen_ld function. I also tried debugging QEMU wtih gdb, but the segfault wasn't thrown immediately after lw instruction like gdbstub does.

Does anyone have any advice?

Thanks,
Libo Zhou

Re:Why on earth is this code giving me Segfaults?

[Libo Zhou]

I'm copying and pasting all my diff below, just in case something else caused the segfault. Any help would be really appreciated guys.

diff --git a/target/mips/mips-defs.h b/target/mips/mips-defs.h
index bbf056a5..8a4acff3 100644
--- a/target/mips/mips-defs.h
+++ b/target/mips/mips-defs.h
@@ -50,6 +50,7 @@
 #define INSN_LOONGSON2F   0x0002000000000000ULL
 #define INSN_VR54XX       0x0004000000000000ULL
 #define INSN_R5900        0x0008000000000000ULL
+#define INSN_MAOTU        0x0010000000000000ULL
 /*
  *   bits 56-63: vendor-specific ASEs
  */
@@ -91,6 +92,9 @@
 /* Wave Computing: "nanoMIPS" */
 #define CPU_NANOMIPS32 (CPU_MIPS32R6 | ISA_NANOMIPS32)
 
+/* Sylincom: "maotu" */
+#define CPU_MAOTU (CPU_MIPS1 | INSN_MAOTU)
+
 /* Strictly follow the architecture standard:
    - Disallow "special" instruction handling for PMON/SPIM.
    Note that we still maintain Count/Compare to match the host clock. */
diff --git a/target/mips/translate.c b/target/mips/translate.c
index ca628002..4e4b6e89 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -29234,7 +29234,11 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
             decode_opc_special3(env, ctx);
         }
 #else
-        decode_opc_special3(env, ctx);
+        if (ctx->insn_flags & INSN_MAOTU) {
+            gen_st(ctx, OPC_SW, rt, rs, imm); /* OPC_MAOTU_SW */
+        } else {
+            decode_opc_special3(env, ctx);
+        }
 #endif
         break;
     case OPC_REGIMM:
@@ -29484,7 +29488,7 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
             gen_compute_branch(ctx, op, 4, rs, rt, imm << 2, 4);
         }
         break;
-    case OPC_BGTZC: /* OPC_BLTZC, OPC_BLTC, OPC_BGTZL */
+    case OPC_BGTZC: /* OPC_BLTZC, OPC_BLTC, OPC_BGTZL, OPC_MAOTU_LW */
         if (ctx->insn_flags & ISA_MIPS32R6) {
             if (rt == 0) {
                 generate_exception_end(ctx, EXCP_RI);
@@ -29492,6 +29496,9 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
             }
             /* OPC_BGTZC, OPC_BLTZC, OPC_BLTC */
             gen_compute_compact_branch(ctx, op, rs, rt, imm << 2);
+        } else if (ctx->insn_flags & INSN_MAOTU) {
+            /* OPC_MAOTU_LW */
+            gen_ld(ctx, OPC_LW, rt, rs, imm);
         } else {
             /* OPC_BGTZL */
             gen_compute_branch(ctx, op, 4, rs, rt, imm << 2, 4);
diff --git a/target/mips/translate_init.inc.c b/target/mips/translate_init.inc.c
index 6d145a90..5b1a7cef 100644
--- a/target/mips/translate_init.inc.c
+++ b/target/mips/translate_init.inc.c
@@ -489,6 +489,10 @@ const mips_def_t mips_defs[] =
                       ASE_MT,
         .mmu_type = MMU_TYPE_R4000,
     },
+    {
+        .name = "maotu",
+        .insn_flags = CPU_MAOTU,
+    },
 #if defined(TARGET_MIPS64)
     {
         .name = "R4000",