retroDE_ps2/docs/ch274_closeout.md

Ch274 closeout — BEQL with squash-on-not-taken; qbert lands in a function prologue, next blocker is SD

Status: Closed. Verdict from re-running qbert.elf: elf_first_unsupported_opcode (pc=0x00112DAC instr=0xFFBF0020) — SD (Store Doubleword, MIPS-III). qbert passed the C++ constructor walker's BEQL correctly, JAL'd into a function at PC 0x00112DAC, and trapped on the very first instruction of that function — the canonical sd $ra, 0x20($sp) register-save prologue.

Numbers

Chapter	Blocker	qbert retire_count
Post-Ch271 (SQ)	DADDU at 0x00100068	26,958
Post-Ch272 (DADDU)	SYSCALL at 0x00100070	26,960
Post-Ch273 (SYSCALL HLE)	BEQL at 0x001000C0	26,980
Post-Ch274 (BEQL)	SD at 0x00112DAC	26,985

The 5-retire delta covers: BEQL squash → addiu $v0, $v1, 4 → lw $a0, 0($v0) → addiu $a1, $v0, 4 → jal 0x00112DAC → first instruction of the called function (SD, traps). The ~78 KB PC jump to 0x00112DAC confirms the BEQL squash worked — qbert's $a0 was NOT clobbered to 0 by the squashed delay slot, the LW loaded the real constructor-pointer, and the JAL dispatched correctly.

What landed

RTL — surgical edits in ee_core_stub.sv

1. Opcode: localparam OP_BEQL = 6'h14 alongside OP_BEQ.
2. Decode: is_beql signal + assign is_beql = (opcode == OP_BEQL).
3. Branch logic: BEQL added to is_branch group and to branch_taken (same (rs_val == rt_val) condition as BEQ).
4. New signal is_beql_squash: is_beql && (rs_val != rt_val) — the load-bearing case.
5. retire_advance: when is_beql_squash is true, next_pc <= pc + 32'd8 (skip the delay slot directly); new_branch_pending stays low so no stale target leaks. Existing BEQ/BNE/jump path unchanged.
6. Decoder allow-list: added !is_beql to the is_nop_class catch-all so SQ doesn't get strict-trap'd.

About 6 LOC of real change.

Focused TB — tb_ee_core_beql.sv

Three cases per Codex's spec:

1. BEQL taken ($t0 == $t1): branch reaches target; delay slot DOES execute (writes a sentinel into $t5). Cross-checked by $t6 = 0xCAFE at the target.
2. BEQL not-taken ($t2 != $t3): delay slot squashed. $t7 = 0x2222 at PC+8 proves we landed correctly past the squash. Inline BNE chain verifies $t5 was NOT clobbered by the squashed delay slot ($t5 stays at its pre-BEQL 0xBEEF0000 value).
3. BEQ not-taken cross-check (same operands): plain BEQ's delay slot DOES execute, so $t5 gets 0xCAB ORed into the low 16 bits ($t5 = 0xBABE0CAB). Proves BEQL's squash differs from BEQ's no-squash behavior.

Encoding gotcha caught during TB authoring: my initial delay slots used ori $t5, $0, ... (clobbers $t5 regardless of prior value) instead of ori $t5, $t5, ... (ORs into $t5, preserving high bits). The first build FAILED the Case-3 check with $t5=0x00000CAB instead of 0xBABE0CAB. Fixed by changing the rs field to RT5 so the delay slot ORs into the existing value — making both "delay-fired" and "delay-squashed" cases distinguishable by the high half-word.

Result: retired=21 halt=1 trap=0 pc=0xbfc00158 errors=0 PASS.

Makefile + regression

• tb_ee_core_beql target.
• Added to both PHONY list and run: master.
• Regression: 161 → 162.

qbert disassembly around the new blocker (PC 0x00112DAC)

The JAL at 0x001000D4 calls into a function at 0x00112DAC. That function's prologue is:

0x00112DAC: 0xFFBF0020   sd $ra, 0x20($sp)   <-- TRAP (opcode 0x3F, MIPS-III SD)

SD (Store Doubleword) is the MIPS-III 64-bit cousin of SW. PS2 ELFs use it everywhere in function prologues to save 64-bit register values ($ra, $s*) onto the stack.

Recommendation for Codex's Ch275

Implement SD as a 2-beat 32-bit-stripe write FSM, mirroring Ch271's SQ pattern but smaller:

• Decode: opcode 6'h3F → is_sd.
• Alignment: SD requires 8-byte alignment (ea[2:0] == 0). Misaligned → AdES path (same as existing SW alignment).
• FSM: reuse the sq_beat counter (or add sd_beat); 2 beats this time. Beat 0 writes rt_val (low 32 bits of $rt) at EA; beat 1 writes 0 at EA+4 (upper 32 bits of $rt not modelled — same approximation we made for SQ beats 1-3).
• For sd $ra,...: real PS2 callees later LD to restore 64-bit $ra. Our model's upper 32 bits are always 0, so the round-trip works as long as the function doesn't do 64-bit math on $ra itself (rare).

Focused TB shape (mirrors tb_ee_core_sq):

• Pre-poke RAM target with non-zero junk.
• Execute sd $rt, 0(base) with $rt non-zero in low 32 bits.
• LW + BNE chain verifies mem[base+0] = rt_val_low and mem[base+4] = 0.
• Direct hierarchical RAM peek for belt-and-braces.

This is structurally identical to Ch271 with 4 → 2 beats and 16 → 8 byte alignment. Should be ~30 minutes of work.

Likely follow-on after SD: LD (Load Doubleword, opcode 0x37). When the called function eventually returns, it'll LD $ra, 0x20($sp) to restore the saved register; our model needs the corresponding 2-beat read path. Codex may want to fold SD+LD into one chapter since they're symmetric.

Files changed

• rtl/ee/ee_core_stub.sv — 6 surgical edits.
• sim/tb/integration/tb_ee_core_beql.sv — new focused TB.
• sim/Makefile — target + both regression lists.

Regression

In flight at the moment of writing; expected 162/162 (was 161, +1 for tb_ee_core_beql).

Process notes

• Cross-check via BEQ in the same TB. Codex specifically asked for the BEQ cross-check, and it caught a real difference: Case 3 (BEQ not-taken) writes $t5 low bits while Case 2 (BEQL not-taken) does NOT. Without the cross- check, a regression where BEQL accidentally behaved like BEQ would silently pass on the "PC landed at PC+8" check alone.
• OR-INTO vs OR-FROM-ZERO encoding bugs are easy to make. My first TB pass had ori $rt, $0, imm (overwriting), which loses info about whether the delay slot fired. Always use ori $rt, $rt, imm (or similar accumulating op) in delay-slot probes so "did it fire?" is observable by a bitwise comparison rather than a value comparison.
• The pattern continues to compress. Ch271 SQ took 5 edits + a TB. Ch272 DADDU took 4 + a TB. Ch273 SYSCALL HLE took 2 + a TB (plus a runner update). Ch274 BEQL is 6 + a TB. Each is a 1-day chapter at most. The qbert progression is now 12 → 26,958 → 26,960 → 26,980 → 26,985 retires — the runner is doing its job.