[Qemu-devel] sparc crash on delayed control-transfer couples

[Steven Seeger]

Consider the following code: 

0x100     cmp %g5, 3
0x104     be 0x200
0x108     b 0x300

I believe this is what is described on page 55 of the sparc v8 manual as 
unpredictable behavior, where a Bicc precedes an unconditional branch.

QEMU actually crashes unless run in GDB. Single stepping will actually have a 
successful compare of %g5==3 executing from 0x300.

Without GDB, qemu crashes with unaligned access at address 2 (JUMP_PC) on the 
fetch.

I understand that this may be "bad code" and may be "unpredictable" but I 
don't think QEMU crashing is an acceptable case. :)

I am not a SPARC expert at all (only started looking at sparc assembly 
yesterday, in fact) so I am not trying to say what the correct behavior it. It 
appears that the be should be a be,a, but is not. This may be a compiler bug 
in what was used to compile this code.

It seems that our board (real hardware) will run at 0x200 and ignore the 
branch. I am attempting to modify translate.c to do just that to see how 
things go.

If anyone else has any ideas, please chime in.

Thanks to you all for what you do.

Steven