Hi, QEMU MIPS emulation fails with code using "illegal" commands in the delay slot of a branch.
I had an endless loop with QEMU running the firmware of a MIPS based router. MIPS says: branches, jumps, ... instructions should not be placed in the delay slot of a branch or jump. Nevertheless, some routers use this kind of code. I wrote a test program to examine the difference between emulation and a real MIPS CPU (see appendices). Results are given below for real hardware, normal emulation and emulation using single stepping. Stefan Compile branch test like this: mipsel-linux-gcc -Os -g btest.c btest2.S AR7 (MIPS 4KEc) router: # ./a.out 0 1100 1000 qemu-system-mipsel (unmodified): # ./a.out 0 # (program hangs) qemu-system-mipsel (single stepping / MIPS_SINGLE_STEP in translate.c): # ./a.out 0 1221 1221
/* Compile branch test like this: mipsel-linux-gcc -Os -g btest.c btest2.S Original code failing with emulation: 218: 8d090000 lw t1,0(t0) 21c: 31290001 andi t1,t1,0x1 220: 1120fffd beqz t1,0x218 224: 03e00008 jr ra 228: 3c088000 lui t0,0x8000 22c: 3c093c1a lui t1,0x3c1a AR7 router: # ./a.out 0 1100 1000 qemu-system-mipsel (unmodified): # ./a.out 0 # (program hangs) qemu-system-mipsel (unmodified): # ./a.out 0 1221 1221 */ #include <stdio.h> extern int test1(int i); extern int test2(int i); int main(void) { int i = 0; printf("%d\n", i); i = test1(0); printf("%d\n", i); i = test2(0); printf("%d\n", i); return 0; }
#if 0 218: 8d090000 lw t1,0(t0) 21c: 31290001 andi t1,t1,0x1 220: 1120fffd beqz t1,0x218 224: 03e00008 jr ra 228: 3c088000 lui t0,0x8000 22c: 3c093c1a lui t1,0x3c1a 230: 35299400 ori t1,t1,0x9400 234: ad090000 sw t1,0(t0) 238: 3c09275a lui t1,0x275a 23c: ad090004 sw t1,4(t0) #endif #include <asm/asm.h> #include <asm/regdef.h> .text .set noreorder .set mips32r2 LEAF(test1) move v0,a0 addiu v0,v0,1000 bnez a0,$L1 jr ra addiu v0,v0,100 $L1: beqz a0,$L2 jr ra addiu v0,v0,10 $L2: addiu v0,v0,1 jr ra nop END(test1) LEAF(test2) move v0,a0 addiu v0,v0,1000 beqz a0,$L3 jr ra addiu v0,v0,100 $L3: bnez a0,$L4 jr ra addiu v0,v0,10 $L4: addiu v0,v0,1 jr ra nop END(test2)
_______________________________________________ Qemu-devel mailing list Qemu-devel@nongnu.org http://lists.nongnu.org/mailman/listinfo/qemu-devel