Re: [Qemu-devel] [Bug] MIPS code fails at branch instruction

[Thiemo Seufer]

Stefan Weil wrote:
> Hi,
> 
> QEMU MIPS emulation fails with code using "illegal" commands
> in the delay slot of a branch.
> 
> I had an endless loop with QEMU running the firmware of a
> MIPS based router.
> 
> MIPS says: branches, jumps, ... instructions should not be
> placed in the delay slot of a branch or jump.
> 
> Nevertheless, some routers use this kind of code.

The architecture spec defines this as undefined behaviour. Other
implementations of MIPS CPUs show funny effects which are hard
to explain without detailed knowledge of the microarchitecture.

> I wrote a test program to examine the difference between emulation
> and a real MIPS CPU (see appendices).

I wouldn't be surprised if it starts to fail for some other combinations
like a mix of branch and branch likely instructions.

(The semantics of a branch delay slot are: The instruction in the delay
slot is executed, then the branch is executed. Now, when the instruction
in the delay slot is itself a branch, what will happen to its delay slot?)


Thiemo