Re: illegal hardware instruction during MIPS-I ELF linux user emulation

[Philippe Mathieu-Daudé]

Hi Libo,

On 9/23/19 10:15 AM, Libo Zhou wrote:
> Hi all,
> 
> I have an binary file generated by a cross compiler. The 'file' command says
> 
> $ file test
> test: ELF 32-bit LSB LSB executable, MIPS, MIPS-I version 1 (SYSV), 
> statically linked, with debug_info, not stripped.

If you look at the mips_defs[] array in
target/mips/translate_init.inc.c, the older ISA implemented is MIPS-II:

$ git grep .insn_flags target/mips/translate_init.inc.c
translate_init.inc.c:75:        .insn_flags = CPU_MIPS32,
translate_init.inc.c:97:        .insn_flags = CPU_MIPS32 | ASE_MIPS16,
translate_init.inc.c:117:        .insn_flags = CPU_MIPS32,
translate_init.inc.c:137:        .insn_flags = CPU_MIPS32 | ASE_MIPS16,
translate_init.inc.c:158:        .insn_flags = CPU_MIPS32R2,
translate_init.inc.c:179:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
translate_init.inc.c:201:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
translate_init.inc.c:223:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16
| ASE_DSP,
translate_init.inc.c:249:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
translate_init.inc.c:297:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16
| ASE_DSP | ASE_MT,
translate_init.inc.c:323:        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16
| ASE_DSP | ASE_DSP_R2,
translate_init.inc.c:343:        .insn_flags = CPU_MIPS32R2 | ASE_MICROMIPS,
translate_init.inc.c:364:        .insn_flags = CPU_MIPS32R2 | ASE_MICROMIPS,
translate_init.inc.c:410:        .insn_flags = CPU_MIPS32R5 | ASE_MSA,
translate_init.inc.c:449:        .insn_flags = CPU_MIPS32R6 | ASE_MICROMIPS,
translate_init.inc.c:488:        .insn_flags = CPU_NANOMIPS32 | ASE_DSP
| ASE_DSP_R2 | ASE_DSP_R3 |
translate_init.inc.c:511:        .insn_flags = CPU_MIPS3,
translate_init.inc.c:531:        .insn_flags = CPU_VR54XX,
translate_init.inc.c:552:        .insn_flags = CPU_MIPS64,
translate_init.inc.c:578:        .insn_flags = CPU_MIPS64,
translate_init.inc.c:607:        .insn_flags = CPU_MIPS64 | ASE_MIPS3D,
translate_init.inc.c:636:        .insn_flags = CPU_MIPS64R2 | ASE_MIPS3D,
translate_init.inc.c:657:        .insn_flags = CPU_MIPS64R2,
translate_init.inc.c:681:        .insn_flags = CPU_MIPS64R2,
translate_init.inc.c:721:        .insn_flags = CPU_MIPS64R6 | ASE_MSA,
translate_init.inc.c:761:        .insn_flags = CPU_MIPS64R6 | ASE_MSA,
translate_init.inc.c:781:        .insn_flags = CPU_LOONGSON2E,
translate_init.inc.c:801:        .insn_flags = CPU_LOONGSON2F,
translate_init.inc.c:830:        .insn_flags = CPU_MIPS64R2 | ASE_DSP |
ASE_DSP_R2,

So currently there is no MIPS-I only CPU.
Note that the code got written with MIPS32 in mind, and implementing
MIPS-I requires a considerable amount of change in the codebase.

> When I executed it with
> 
> $./qemu-mipsel test
> qemu: uncaught target signal 4 (Illegal instruction) - core dumped
> [1] 11088 illegal hardware instruction (core dumped) ./qemu-mipsel test

You can try ./qemu-mipsel -d in_asm,int test to display debugging
information, you might see which instruction trapped.

IMO it is likely the RFE (Return from Exception) instruction.

Regards,

Phil.

> However, when I use another cross compiler that generates MIPS32 rel2 
> binaries, it worked fine.
> 
> Can anyone tell me what's going wrong?
> 
> Cheers,
> Libo Zhou
>