Using the BC1ANY4F instruction with a 24Kf core (MIPS32R2 & ASE_MIPS16) we get:
$ echo -ne '\x03\x20\xf8\x09EEEE' > cop1x.bin $ qemu-system-mipsel -bios cop1x.bin unknown branch 0x13000 Aborted (core dumped) (gdb) bt #0 0x00007fe2d38b1e35 in raise () at /lib64/libc.so.6 #1 0x00007fe2d389c895 in abort () at /lib64/libc.so.6 #2 0x000055aa9fe066e5 in gen_branch (ctx=0x7fe27bdfa590, insn_bytes=4) at target/mips/translate.c:13167 #3 0x000055aa9fe2baf4 in mips_tr_translate_insn (dcbase=0x7fe27bdfa590, cs=0x55aaa0e2d530) at target/mips/translate.c:30928 #4 0x000055aa9fd40138 in translator_loop (ops=0x55aaa05e94e0 <mips_tr_ops>, db=0x7fe27bdfa590, cpu=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at accel/tcg/translator.c:102 #5 0x000055aa9fe2bd21 in gen_intermediate_code (cs=0x55aaa0e2d530, tb=0x7fe284000040 <code_gen_buffer+19>, max_insns=512) at target/mips/translate.c:30999 #6 0x000055aa9fd3e3d4 in tb_gen_code (cpu=0x55aaa0e2d530, pc=3217031168, cs_base=0, flags=268435600, cflags=-16252928) at accel/tcg/translate-all.c:1718 #7 0x000055aa9fd3ac06 in tb_find (cpu=0x55aaa0e2d530, last_tb=0x0, tb_exit=0, cf_mask=524288) at accel/tcg/cpu-exec.c:407 #8 0x000055aa9fd3b4d5 in cpu_exec (cpu=0x55aaa0e2d530) at accel/tcg/cpu-exec.c:731 #9 0x000055aa9fcfe33a in tcg_cpu_exec (cpu=0x55aaa0e2d530) at cpus.c:1405 #10 0x000055aa9fcfeb90 in qemu_tcg_cpu_thread_fn (arg=0x55aaa0e2d530) at cpus.c:1713 #11 0x000055aaa02ea7d7 in qemu_thread_start (args=0x55aaa0e465f0) at util/qemu-thread-posix.c:519 #12 0x00007fe2d3a484c0 in start_thread () at /lib64/libpthread.so.0 #13 0x00007fe2d3976163 in clone () at /lib64/libc.so.6 This is because this COP1X instruction generates a Reserved Instruction when used with this core, however we are in a delay slot, and exceptions in delay slot are architecturally unpredictable. Core dumps confunse users. Instead, report a friendlier error message: $ qemu-system-mipsel -bios cop1x.bin qemu-system-mipsel: Exception in delay slot is UNPREDICTABLE Buglink: https://bugs.launchpad.net/qemu/+bug/1663287 Signed-off-by: Philippe Mathieu-Daudé <f4...@amsat.org> --- target/mips/translate.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/target/mips/translate.c b/target/mips/translate.c index 25b595a17d..99e675b87a 100644 --- a/target/mips/translate.c +++ b/target/mips/translate.c @@ -30925,6 +30925,10 @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) } } if (is_slot) { + if (ctx->base.is_jmp == DISAS_NORETURN) { + error_report("Exception in delay slot is UNPREDICTABLE"); + exit(1); + } gen_branch(ctx, insn_bytes); } ctx->base.pc_next += insn_bytes; -- 2.21.1
