[Qemu-devel] sparc crash on delayed control-transfer couples

[Qemu-devel] sparc crash on delayed control-transfer couples

[Steven Seeger]

Consider the following code: 

0x100     cmp %g5, 3
0x104     be 0x200
0x108     b 0x300

I believe this is what is described on page 55 of the sparc v8 manual as 
unpredictable behavior, where a Bicc precedes an unconditional branch.

QEMU actually crashes unless run in GDB. Single stepping will actually have a 
successful compare of %g5==3 executing from 0x300.

Without GDB, qemu crashes with unaligned access at address 2 (JUMP_PC) on the 
fetch.

I understand that this may be "bad code" and may be "unpredictable" but I 
don't think QEMU crashing is an acceptable case. :)

I am not a SPARC expert at all (only started looking at sparc assembly 
yesterday, in fact) so I am not trying to say what the correct behavior it. It 
appears that the be should be a be,a, but is not. This may be a compiler bug 
in what was used to compile this code.

It seems that our board (real hardware) will run at 0x200 and ignore the 
branch. I am attempting to modify translate.c to do just that to see how 
things go.

If anyone else has any ideas, please chime in.

Thanks to you all for what you do.

Steven

Re: [Qemu-devel] sparc crash on delayed control-transfer couples

[Mark Cave-Ayland]

On 13/02/18 21:01, Steven Seeger wrote:

> Consider the following code:
> 
> 0x100     cmp %g5, 3
> 0x104     be 0x200
> 0x108     b 0x300
> 
> I believe this is what is described on page 55 of the sparc v8 manual as
> unpredictable behavior, where a Bicc precedes an unconditional branch.
> 
> QEMU actually crashes unless run in GDB. Single stepping will actually have a
> successful compare of %g5==3 executing from 0x300.
> 
> Without GDB, qemu crashes with unaligned access at address 2 (JUMP_PC) on the
> fetch.
> 
> I understand that this may be "bad code" and may be "unpredictable" but I
> don't think QEMU crashing is an acceptable case. :)
> 
> I am not a SPARC expert at all (only started looking at sparc assembly
> yesterday, in fact) so I am not trying to say what the correct behavior it. It
> appears that the be should be a be,a, but is not. This may be a compiler bug
> in what was used to compile this code.
> 
> It seems that our board (real hardware) will run at 0x200 and ignore the
> branch. I am attempting to modify translate.c to do just that to see how
> things go.
> 
> If anyone else has any ideas, please chime in.
> 
> Thanks to you all for what you do.

Yeah this is when it starts getting tricky... I agree that QEMU 
definitely shouldn't crash but trying to figure out what the behaviour 
should be is the hard part.

Can you tell me a bit about your real hardware and whether it matches 
the behaviour of QEMU here?


ATB,

Mark.