Illegal delay slot code causes abort on mips64
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Expired
|
Undecided
|
Unassigned |
Bug Description
During some randomised testing of an experimental MIPS implementation I found an instruction sequence that also causes aborts on mainline qemu's MIPS support. The problem is triggered by an MSA branch instruction appearing in a delay slot when emulating a processor without MSA support.
For example, with the current repository HEAD (f073cd3a2bf105
mips64-
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbf
The jr sets up a jump, and hflags is set accordingly in gen_compute_branch (in target/
I suspect the best fix is to remove the instruction set condition from the delay slot check in gen_msa_branch.
Changed in qemu: | |
status: | New → Fix Committed |
Changed in qemu: | |
status: | Fix Released → New |
tags: | added: mips |
Changed in qemu: | |
assignee: | nobody → Philippe Mathieu-Daudé (philmd) |
Changed in qemu: | |
status: | New → Confirmed |
I've just found the same problem with gen_compute_ branch1,
00200008 jr at fbfc158ec
4540563a bc1any4f $fcc0,0xfffffff
The cause is the same - if the instruction set is wrong then the delay slot check is skipped.