68000 CMPM address register updated before address error?

[larsbrinkhoff]

Consider this test case. A4 is odd, so there's an address error. Yet, the "final" value is incremented by 2, as if the post increment happened before or in parallel with the memory access. Is this known to be the case on real hardware?

{ "name": "b74c [CMP.w (A4)+, (A3)+] 6",
  "initial":
    {"d0": 3616035900,
     "d1": 4244842335,
     "d2": 3804844838,
     "d3": 2486760049,
     "d4": 2154476239,
     "d5": 2057425795,
     "d6": 3717306163,
     "d7": 806500645,
     "a0": 2013264249,
     "a1": 2727369354,
     "a2": 3820627603,
     "a3": 3490029285,
     "a4": 900360119,
     "a5": 1926964183,
     "a6": 2103704679,
     "usp": 882354928,
     "ssp": 2048,
     "sr": 9985,
     "pc": 3072,
     "prefetch": [46924, 41774],
     "ram": [[5123, 95], [5122, 244], [5121, 175], [5120, 52], [15, 0], [14, 20], [13, 0], [12, 0]]},
  "final":
    {"d0": 3616035900,
     "d1": 4244842335,
     "d2": 3804844838,
     "d3": 2486760049,
     "d4": 2154476239,
     "d5": 2057425795,
     "d6": 3717306163,
     "d7": 806500645,
     "a0": 2013264249,
     "a1": 2727369354,
     "a2": 3820627603,
     "a3": 3490029285,
     "a4": 900360121,
     "a5": 1926964183,
     "a6": 2103704679,
     "usp": 882354928,
     "ssp": 2034,
     "sr": 9985,
     "pc": 5120,
     "prefetch": [13487, 62559],
     "ram": [[13, 0], [2037, 170], [12, 0], [2036, 53], [2035, 85], [5121, 175], [15, 0], [2039, 183], [5120, 52], [14, 20], [2038, 103], [5123, 95], [2041, 76], [5122, 244], [2040, 183], [2034, 183], [2045, 0], [2044, 0], [2043, 1], [2042, 39], [2047, 0], [2046, 12]]},
  "length": 50,
  "transactions":
    [["n", 4],
     ["w", 4, 5, 2046, ".w", 3072],
     ["w", 4, 5, 2042, ".w", 9985],
     ["w", 4, 5, 2044, ".w", 0],
     ["w", 4, 5, 2040, ".w", 46924],
     ["w", 4, 5, 2038, ".w", 26551],
     ["w", 4, 5, 2034, ".w", 46933],
     ["w", 4, 5, 2036, ".w", 13738],
     ["r", 4, 5, 12, ".w", 0],
     ["r", 4, 5, 14, ".w", 5120],
     ["r", 4, 6, 5120, ".w", 13487],
     ["n", 2],
     ["r", 4, 6, 5122, ".w", 62559]]},

[larsbrinkhoff]

I have identified more test cases that have side effects happen before the exception, but I'll hold off on those until I hear back. For all I know, they might be faithful to the hardware, or indeed recorded with a real device!

[galibert]

for cmpm.w (ay)+, (ax)+ the ay writeback happens in parallel to the access, but the ax writeback after its access. An access starts with writing to aob, ends where the read() is, extending a microcode instruction from 2 cycles to 4 if it's in the same one.

06b cmmw1: aob=ay, au=ay+2
086 cmmw2: ay=au, dbin=read(aob)
122 cmmw3: aob=ax, au=ax+2, aluo = dbin & ffff, dbin = read(aob)
170 cmmw4: ax=au, aob=pc, au=pc+2, aluo = aluo - dbin, set flags nzvc, irc = read(aob)

(it then goes to the next instruction)

[TomHarte]

The tests were generated via software emulation with what is — evidently — a flawed emulation.

@galibert can you provide the source for those quotes. Is there somewhere cleaner to obtain this information than the original patents?

[galibert]

My sources are https://github.com/ijor/fx68k , https://og.kervella.org/m68k/schem and a bunch of other work. You can refer to https://raw.githubusercontent.com/mamedev/mame/master/src/devices/cpu/m68000/m68000-sdf.cpp to see the decompiled-from-microcode behaviour of each instruction.