Stefan Weil wrote: > Hi, > > QEMU MIPS emulation fails with code using "illegal" commands > in the delay slot of a branch. > > I had an endless loop with QEMU running the firmware of a > MIPS based router. > > MIPS says: branches, jumps, ... instructions should not be > placed in the delay slot of a branch or jump. > > Nevertheless, some routers use this kind of code.
The architecture spec defines this as undefined behaviour. Other implementations of MIPS CPUs show funny effects which are hard to explain without detailed knowledge of the microarchitecture. > I wrote a test program to examine the difference between emulation > and a real MIPS CPU (see appendices). I wouldn't be surprised if it starts to fail for some other combinations like a mix of branch and branch likely instructions. (The semantics of a branch delay slot are: The instruction in the delay slot is executed, then the branch is executed. Now, when the instruction in the delay slot is itself a branch, what will happen to its delay slot?) Thiemo _______________________________________________ Qemu-devel mailing list Qemu-devel@nongnu.org http://lists.nongnu.org/mailman/listinfo/qemu-devel
