target-openrisc: Fix exception handling status registers

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 
     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

Signature · 1 line

2.9.3

Hello,

Sorry for the duplicate. There was an issue with my copy to qemu-devel group. Resent to everyone with proper cc to qemu-devel.

Please ignore this one.

-Stafford

Quoted 41 lines · Stafford Horne

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 

target/openrisc/interrupt.c void openrisc_cpu_do_interrupt(CPUState *cs) · line 54

Quoted 2 lines

target/openrisc/interrupt.c +0 -0

     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

Quoted 3 lines

--
2.9.3

Hi all,

Quoted 51 lines · Stafford Horne

Hello,

Sorry for the duplicate. There was an issue with my copy to qemu-devel group. Resent to everyone with proper cc to qemu-devel.

Please ignore this one.

-Stafford

Quoted 41 lines · Stafford Horne

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 

Quoted 2 lines

target/openrisc/interrupt.c void openrisc_cpu_do_interrupt(CPUState *cs) · line 54

Quoted 2 lines

target/openrisc/interrupt.c +0 -0

     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

Anyone wanna take the openrisc job in QEMU?
Will you Stafford?
I really don't have time working on it.

And, this is the lwa&swa support.
It also make latest Linux boot.

target-openrisc/cpu.c +1 -0

index 155913f..e6f6186 100644
@@ -55,6 +55,7 @@ static void openrisc_cpu_reset(CPUState *s)
 
     cpu->env.pc = 0x100;
     cpu->env.sr = SR_FO | SR_SM;
+    cpu->env.lock_addr = -1;
     s->exception_index = -1;
 
     cpu->env.upr = UPR_UP | UPR_DMP | UPR_IMP | UPR_PICP | UPR_TTP;

target-openrisc/cpu.h +3 -0

index aaf1535..d64c54f 100644
@@ -296,6 +296,9 @@ typedef struct CPUOpenRISCState {
     uint32_t fpcsr;           /* Float register */
     float_status fp_status;
 
+    target_ulong lock_addr;
+    target_ulong lock_value;
+
     uint32_t flags;           /* cpu_flags, we only use it for exception
                                  in solt so far.  */
     uint32_t btaken;          /* the SR_F bit */

target-openrisc/interrupt.c +1 -0

index 5fe3f11..2c4f452 100644
@@ -55,6 +55,7 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
     env->sr &= ~SR_TEE;
     env->tlb->cpu_openrisc_map_address_data = &cpu_openrisc_get_phys_nommu;
     env->tlb->cpu_openrisc_map_address_code = &cpu_openrisc_get_phys_nommu;
+    env->lock_addr = -1;
 
     if (cs->exception_index > 0 && cs->exception_index < EXCP_NR) {
         env->pc = (cs->exception_index << 8);

target-openrisc/interrupt_helper.c +1 -0

index 116f9109..a1d3a9b 100644
@@ -34,6 +34,7 @@ void HELPER(rfe)(CPUOpenRISCState *env)
     cpu->env.pc = cpu->env.epcr;
     cpu->env.npc = cpu->env.epcr;
     cpu->env.sr = cpu->env.esr;
+    cpu->env.lock_addr = -1;
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->env.sr & SR_DME) {

target-openrisc/mmu.c +1 -0

index 505dcdc..56b11d3 100644
@@ -174,6 +174,7 @@ static void cpu_openrisc_raise_mmu_exception(OpenRISCCPU *cpu,
 
     cs->exception_index = exception;
     cpu->env.eear = address;
+    cpu->env.lock_addr = -1;
 }
 
 #ifndef CONFIG_USER_ONLY

target-openrisc/translate.c +56 -0

index 28c9446..1185a00 100644
@@ -61,6 +61,8 @@ static TCGv jmp_pc;            /* l.jr/l.jalr temp pc */
 static TCGv cpu_npc;
 static TCGv cpu_ppc;
 static TCGv_i32 env_btaken;    /* bf/bnf , F flag taken */
+static TCGv cpu_lock_addr;
+static TCGv cpu_lock_value;
 static TCGv_i32 fpcsr;
 static TCGv machi, maclo;
 static TCGv fpmaddhi, fpmaddlo;

@@ -95,6 +97,12 @@ void openrisc_translate_init(void)
     env_btaken = tcg_global_mem_new_i32(cpu_env,
                                         offsetof(CPUOpenRISCState, btaken),
                                         "btaken");
+    cpu_lock_addr = tcg_global_mem_new(cpu_env,
+                                       offsetof(CPUOpenRISCState, lock_addr),
+                                       "lock_addr");
+    cpu_lock_value = tcg_global_mem_new(cpu_env,
+                                        offsetof(CPUOpenRISCState, lock_value),
+                                        "lock_value");
     fpcsr = tcg_global_mem_new_i32(cpu_env,
                                    offsetof(CPUOpenRISCState, fpcsr),
                                    "fpcsr");

@@ -264,6 +272,44 @@ static void gen_jump(DisasContext *dc, uint32_t imm, uint32_t reg, uint32_t op0)
     gen_sync_flags(dc);
 }
 
+static void gen_lwa(DisasContext *dc, TCGv rd, TCGv ra, int32_t ofs)
+{
+    TCGv ea = tcg_temp_new();
+
+    tcg_gen_addi_tl(ea, ra, ofs);
+    tcg_gen_qemu_ld_tl(rd, ea, dc->mem_idx, MO_TEUL);
+    tcg_gen_mov_tl(cpu_lock_addr, ea);
+    tcg_gen_mov_tl(cpu_lock_value, rd);
+    tcg_temp_free(ea);
+}
+
+static void gen_swa(DisasContext *dc, TCGv rb, TCGv ra, int32_t ofs)
+{
+    TCGv ea, val;
+    TCGLabel *lab_fail, *lab_done;
+
+    ea = tcg_temp_new();
+    tcg_gen_addi_tl(ea, ra, ofs);
+
+    lab_fail = gen_new_label();
+    lab_done = gen_new_label();
+    tcg_gen_brcond_tl(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
+    tcg_temp_free(ea);
+
+    val = tcg_temp_new();
+    tcg_gen_qemu_ld_tl(val, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_brcond_tl(TCG_COND_NE, val, cpu_lock_value, lab_fail);
+
+    tcg_gen_qemu_st_tl(rb, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_movi_i32(env_btaken, 0x1);
+    tcg_gen_br(lab_done);
+
+    gen_set_label(lab_fail);
+    tcg_gen_movi_i32(env_btaken, 0x0);
+
+    gen_set_label(lab_done);
+    tcg_gen_movi_tl(cpu_lock_addr, -1);
+}
 
 static void dec_calc(DisasContext *dc, uint32_t insn)
 {

@@ -858,6 +904,11 @@ static void dec_misc(DisasContext *dc, uint32_t insn)
         goto do_load;
 #endif*/
 
+    case 0x1b: /* l.lwa */
+        LOG_DIS("l.lwa r%d, r%d, %d\n", rd, ra, I16);
+        gen_lwa(dc, cpu_R[rd], cpu_R[ra], I16);
+        break;
+
     case 0x21:    /* l.lwz */
         LOG_DIS("l.lwz r%d, r%d, %d\n", rd, ra, I16);
         mop = MO_TEUL;

@@ -1036,6 +1087,11 @@ static void dec_misc(DisasContext *dc, uint32_t insn)
         goto do_store;
 #endif*/
 
+    case 0x33: /* l.swa */
+        LOG_DIS("l.swa r%d, r%d, %d\n", ra, rb, I16);
+        gen_swa(dc, cpu_R[rb], cpu_R[ra], sign_extend(tmp, 16));
+        break;
+
     case 0x35:    /* l.sw */
         LOG_DIS("l.sw %d, r%d, r%d, %d\n", I5, ra, rb, I11);
         mop = MO_TEUL;

Hello,

Quoted 54 lines · Jia Liu

Hi all,

Quoted 51 lines · Stafford Horne

Hello,

Sorry for the duplicate. There was an issue with my copy to qemu-devel group. Resent to everyone with proper cc to qemu-devel.

Please ignore this one.

-Stafford

Quoted 41 lines · Stafford Horne

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 

Quoted 6 lines

Quoted 2 lines

target/openrisc/interrupt.c void openrisc_cpu_do_interrupt(CPUState *cs) · line 54

Quoted 2 lines

target/openrisc/interrupt.c +0 -0

     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

Anyone wanna take the openrisc job in QEMU?
Will you Stafford?
I really don't have time working on it.

I don't mind watching the the mailing list and collecting patchs and sending pull requests for openrisc.

But if anyone is more willing to take over the role I would not step in their way. I only have a few days experience with the qemu code base. But I do think its very nice :)

I think I would need my key signed, do you know anyone in Japan?

Quoted 2 lines

And, this is the lwa&swa support.
It also make latest Linux boot.

Thanks, I know about these patches from Sebastian. In my case I explicity wanted to fix the illegal instruction handling logic as I am testing the instruction emulation patch for lwa/swa which I am preparing for the next kernel merge window. (I am currently the Linux openrisc maintainer)

I think the l.swa and l.lwa support should go in too. I have tested those instructions on fpga and the or1ksim simulator.

-Stafford

Quoted 157 lines

target-openrisc/cpu.c +1 -0

index 155913f..e6f6186 100644
@@ -55,6 +55,7 @@ static void openrisc_cpu_reset(CPUState *s)
 
     cpu->env.pc = 0x100;
     cpu->env.sr = SR_FO | SR_SM;
+    cpu->env.lock_addr = -1;
     s->exception_index = -1;
 
     cpu->env.upr = UPR_UP | UPR_DMP | UPR_IMP | UPR_PICP | UPR_TTP;

target-openrisc/cpu.h +3 -0

index aaf1535..d64c54f 100644
@@ -296,6 +296,9 @@ typedef struct CPUOpenRISCState {
     uint32_t fpcsr;           /* Float register */
     float_status fp_status;
 
+    target_ulong lock_addr;
+    target_ulong lock_value;
+
     uint32_t flags;           /* cpu_flags, we only use it for exception
                                  in solt so far.  */
     uint32_t btaken;          /* the SR_F bit */

target-openrisc/interrupt.c +1 -0

index 5fe3f11..2c4f452 100644
@@ -55,6 +55,7 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
     env->sr &= ~SR_TEE;
     env->tlb->cpu_openrisc_map_address_data = &cpu_openrisc_get_phys_nommu;
     env->tlb->cpu_openrisc_map_address_code = &cpu_openrisc_get_phys_nommu;
+    env->lock_addr = -1;
 
     if (cs->exception_index > 0 && cs->exception_index < EXCP_NR) {
         env->pc = (cs->exception_index << 8);

target-openrisc/interrupt_helper.c +1 -0

index 116f9109..a1d3a9b 100644
@@ -34,6 +34,7 @@ void HELPER(rfe)(CPUOpenRISCState *env)
     cpu->env.pc = cpu->env.epcr;
     cpu->env.npc = cpu->env.epcr;
     cpu->env.sr = cpu->env.esr;
+    cpu->env.lock_addr = -1;
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->env.sr & SR_DME) {

target-openrisc/mmu.c +1 -0

index 505dcdc..56b11d3 100644
@@ -174,6 +174,7 @@ static void cpu_openrisc_raise_mmu_exception(OpenRISCCPU *cpu,
 
     cs->exception_index = exception;
     cpu->env.eear = address;
+    cpu->env.lock_addr = -1;
 }
 
 #ifndef CONFIG_USER_ONLY

target-openrisc/translate.c +56 -0

index 28c9446..1185a00 100644
@@ -61,6 +61,8 @@ static TCGv jmp_pc;            /* l.jr/l.jalr temp pc */
 static TCGv cpu_npc;
 static TCGv cpu_ppc;
 static TCGv_i32 env_btaken;    /* bf/bnf , F flag taken */
+static TCGv cpu_lock_addr;
+static TCGv cpu_lock_value;
 static TCGv_i32 fpcsr;
 static TCGv machi, maclo;
 static TCGv fpmaddhi, fpmaddlo;

@@ -95,6 +97,12 @@ void openrisc_translate_init(void)
     env_btaken = tcg_global_mem_new_i32(cpu_env,
                                         offsetof(CPUOpenRISCState, btaken),
                                         "btaken");
+    cpu_lock_addr = tcg_global_mem_new(cpu_env,
+                                       offsetof(CPUOpenRISCState, lock_addr),
+                                       "lock_addr");
+    cpu_lock_value = tcg_global_mem_new(cpu_env,
+                                        offsetof(CPUOpenRISCState, lock_value),
+                                        "lock_value");
     fpcsr = tcg_global_mem_new_i32(cpu_env,
                                    offsetof(CPUOpenRISCState, fpcsr),
                                    "fpcsr");

@@ -264,6 +272,44 @@ static void gen_jump(DisasContext *dc, uint32_t imm, uint32_t reg, uint32_t op0)
     gen_sync_flags(dc);
 }
 
+static void gen_lwa(DisasContext *dc, TCGv rd, TCGv ra, int32_t ofs)
+{
+    TCGv ea = tcg_temp_new();
+
+    tcg_gen_addi_tl(ea, ra, ofs);
+    tcg_gen_qemu_ld_tl(rd, ea, dc->mem_idx, MO_TEUL);
+    tcg_gen_mov_tl(cpu_lock_addr, ea);
+    tcg_gen_mov_tl(cpu_lock_value, rd);
+    tcg_temp_free(ea);
+}
+
+static void gen_swa(DisasContext *dc, TCGv rb, TCGv ra, int32_t ofs)
+{
+    TCGv ea, val;
+    TCGLabel *lab_fail, *lab_done;
+
+    ea = tcg_temp_new();
+    tcg_gen_addi_tl(ea, ra, ofs);
+
+    lab_fail = gen_new_label();
+    lab_done = gen_new_label();
+    tcg_gen_brcond_tl(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
+    tcg_temp_free(ea);
+
+    val = tcg_temp_new();
+    tcg_gen_qemu_ld_tl(val, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_brcond_tl(TCG_COND_NE, val, cpu_lock_value, lab_fail);
+
+    tcg_gen_qemu_st_tl(rb, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_movi_i32(env_btaken, 0x1);
+    tcg_gen_br(lab_done);
+
+    gen_set_label(lab_fail);
+    tcg_gen_movi_i32(env_btaken, 0x0);
+
+    gen_set_label(lab_done);
+    tcg_gen_movi_tl(cpu_lock_addr, -1);
+}
 
 static void dec_calc(DisasContext *dc, uint32_t insn)
 {

@@ -858,6 +904,11 @@ static void dec_misc(DisasContext *dc, uint32_t insn)
         goto do_load;
 #endif*/
 
+    case 0x1b: /* l.lwa */
+        LOG_DIS("l.lwa r%d, r%d, %d\n", rd, ra, I16);
+        gen_lwa(dc, cpu_R[rd], cpu_R[ra], I16);
+        break;
+
     case 0x21:    /* l.lwz */
         LOG_DIS("l.lwz r%d, r%d, %d\n", rd, ra, I16);
         mop = MO_TEUL;

@@ -1036,6 +1087,11 @@ static void dec_misc(DisasContext *dc, uint32_t insn)
         goto do_store;
 #endif*/
 
+    case 0x33: /* l.swa */
+        LOG_DIS("l.swa r%d, r%d, %d\n", ra, rb, I16);
+        gen_swa(dc, cpu_R[rb], cpu_R[ra], sign_extend(tmp, 16));
+        break;
+
     case 0x35:    /* l.sw */
         LOG_DIS("l.sw %d, r%d, r%d, %d\n", I5, ra, rb, I11);
         mop = MO_TEUL;

(+CC Rth)

I believe you also have some experience with openrisc. Any thought on the below?

Quoted 57 lines · Stafford Horne

Hello,

Quoted 54 lines · Jia Liu

Hi all,

Quoted 51 lines · Stafford Horne

Hello,

Sorry for the duplicate. There was an issue with my copy to qemu-devel group. Resent to everyone with proper cc to qemu-devel.

Please ignore this one.

-Stafford

Quoted 41 lines · Stafford Horne

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

target/openrisc/interrupt.c void openrisc_cpu_do_interrupt(CPUState *cs) · line 54

Quoted 2 lines

target/openrisc/interrupt.c +0 -0

     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

Quoted 19 lines

Quoted 19 lines

target-openrisc/translate.c +19 -0

+static void gen_swa(DisasContext *dc, TCGv rb, TCGv ra, int32_t ofs)
+{
+    TCGv ea, val;
+    TCGLabel *lab_fail, *lab_done;
+
+    ea = tcg_temp_new();
+    tcg_gen_addi_tl(ea, ra, ofs);
+
+    lab_fail = gen_new_label();
+    lab_done = gen_new_label();
+    tcg_gen_brcond_tl(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
+    tcg_temp_free(ea);
+
+    val = tcg_temp_new();
+    tcg_gen_qemu_ld_tl(val, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_brcond_tl(TCG_COND_NE, val, cpu_lock_value, lab_fail);
+
+    tcg_gen_qemu_st_tl(rb, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_movi_i32(env_btaken, 0x1);

Quoted 8 lines

target-openrisc/translate.c static void gen_jump(DisasContext *dc, uint32_t imm, uint32_t reg, uint32_t op0) · line 312

Quoted 8 lines

target-openrisc/translate.c +8 -0

+    tcg_gen_br(lab_done);
+
+    gen_set_label(lab_fail);
+    tcg_gen_movi_i32(env_btaken, 0x0);
+
+    gen_set_label(lab_done);
+    tcg_gen_movi_tl(cpu_lock_addr, -1);
+}

Quoted 63 lines · Stafford Horne

(+CC Rth)

I believe you also have some experience with openrisc. Any thought on the below?

Quoted 57 lines · Stafford Horne

Hello,

Quoted 54 lines · Jia Liu

Hi all,

Quoted 51 lines · Stafford Horne

Hello,

Sorry for the duplicate. There was an issue with my copy to qemu-devel group. Resent to everyone with proper cc to qemu-devel.

Please ignore this one.

-Stafford

Quoted 41 lines · Stafford Horne

I am working on testing instruction emulation patches for the linux kernel. During testing I found these 2 issues:

- sets DSX (delay slot exception) but never clears it
- EEAR for illegal insns should point to the bad exception (as per openrisc spec) but its not

This patch fixes these two issues by clearing the DSX flag when not in a delay slot and by setting EEAR to exception PC when handling illegal instruction exceptions.

After this patch the openrisc kernel with latest patches boots great on qemu and instruction emulation works.

Cc qemu-trivial at nongnu.org

Cc openrisc at lists.librecores.org

Signed-off-by Stafford Horne <[email protected]>

---
 target/openrisc/interrupt.c | 7 +++++++
 1 file changed, 7 insertions(+)

target/openrisc/interrupt.c +7 -0

index 5fe3f11..e1b0142 100644
@@ -38,10 +38,17 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
         env->epcr -= 4;
+    } else {
+        env->sr &= ~SR_DSX;
     }
     if (cs->exception_index == EXCP_SYSCALL) {
         env->epcr += 4;
     }
+    /* When we have an illegal instruction the error effective address
+       shall be set to the illegal instruction address.  */
+    if (cs->exception_index == EXCP_ILLEGAL) {
+        env->eear = env->pc;
+    }
 

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

target/openrisc/interrupt.c void openrisc_cpu_do_interrupt(CPUState *cs) · line 54

Quoted 2 lines

target/openrisc/interrupt.c +0 -0

     /* For machine-state changed between user-mode and supervisor mode,
        we need flush TLB when we enter&exit EXCP.  */

This patch seems sane, and I'm fine with it. That said, I don't know what "latest patches" means, and was not able to find a kernel version that works.

Quoted 22 lines

Quoted 22 lines

Quoted 22 lines

target-openrisc/translate.c +22 -0

+static void gen_swa(DisasContext *dc, TCGv rb, TCGv ra, int32_t ofs)
+{
+    TCGv ea, val;
+    TCGLabel *lab_fail, *lab_done;
+
+    ea = tcg_temp_new();
+    tcg_gen_addi_tl(ea, ra, ofs);
+
+    lab_fail = gen_new_label();
+    lab_done = gen_new_label();
+    tcg_gen_brcond_tl(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
+    tcg_temp_free(ea);
+
+    val = tcg_temp_new();
+    tcg_gen_qemu_ld_tl(val, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_brcond_tl(TCG_COND_NE, val, cpu_lock_value, lab_fail);
+
+    tcg_gen_qemu_st_tl(rb, cpu_lock_addr, dc->mem_idx, MO_TEUL);
+    tcg_gen_movi_i32(env_btaken, 0x1);
+    tcg_gen_br(lab_done);
+
+    gen_set_label(lab_fail);

Quoted 5 lines

Quoted 5 lines

target-openrisc/translate.c static void gen_jump(DisasContext *dc, uint32_t imm, uint32_t reg, uint32_t op0) · line 312

Quoted 5 lines

target-openrisc/translate.c +5 -0

+    tcg_gen_movi_i32(env_btaken, 0x0);
+
+    gen_set_label(lab_done);
+    tcg_gen_movi_tl(cpu_lock_addr, -1);
+}

This one needs to be updated to work with the atomic operations now present in TCG. See target/alpha/translate.c, gen_store_conditional among the many examples.

If you are having problems booting, both mainline (4.10-rc5) and linux-next (i.e. next-201701124) should be able to boot. i.e.

export ARCH=openrisc
make defconfig # defconfig works fine on qemu

  # make any updates to CONFIG_CROSS_COMPILE needed
  make

  # start qemu
  qemu-system-or32  -cpu or1200 -M or32-sim -kernel $LINUX/vmlinux \
   -serial stdio -nographic -monitor none

I just ran those commands with linu-next and my qemu patches and the kernel can boot, but note fails to find init due to config missing initramfs, which I figure you know thats expected.

Let me know what you tried and what problem you are having.

        cpu = of_find_compatible_node(NULL, NULL, "opencores,or1200-rtlsvn481");
        if (!cpu)
                panic("No compatible CPU found in device tree...\n");

Quoted 13 lines · Stafford Horne

If you are having problems booting, both mainline (4.10-rc5) and linux-next (i.e. next-201701124) should be able to boot. i.e.

export ARCH=openrisc
make defconfig # defconfig works fine on qemu

  # make any updates to CONFIG_CROSS_COMPILE needed
  make

  # start qemu
  qemu-system-or32  -cpu or1200 -M or32-sim -kernel $LINUX/vmlinux \
   -serial stdio -nographic -monitor none

Quoted 5 lines

I just ran those commands with linu-next and my qemu patches and the kernel can boot, but note fails to find init due to config missing initramfs, which I figure you know thats expected.

Let me know what you tried and what problem you are having.

I've tried booting linux-next and mainline, both from yesterday.

According to the trace from qemu (-D z -d in_asm,exec), I execute

./or32-softmmu/qemu-system-or32 -cpu or1200 -M or32-sim \
    -kernel ~/work/linux/bld-or/vmlinux -append console=ttyS0 \
    -serial stdio -nographic -monitor none \
    -D z -d in_asm,exec,int,op_opt

...
Trace 0x7f501130a880 [0: c036c650] setup_cpuinfo Trace 0x7f501130a990 [0: c036c65c] setup_cpuinfo Trace 0x7f501130aaa0 [0: c0069774] panic
...
Trace 0x7f5011312b70 [0: 000001fc]
Trace 0x7f5011312b70 [0: 000001fc]

That last block repeats forever.

The qemu I'm using is

git://github.com/rth7680/qemu.git tgt-or1k-2

which has your patch, l.lwa/swa, and a cleanup to the disassembly trace.

Looking at the kernel source I would hazard a guess that it's

Quoted 3 lines

        cpu = of_find_compatible_node(NULL, NULL, "opencores,or1200-rtlsvn481");
        if (!cpu)
                panic("No compatible CPU found in device tree...\n");

which suggests some large configuration error.

Hmm, I just tried your qemu branch and mine:

git at github.com:stffrdhrn/qemu.git or1k-fix-sigill

Both of them were able to boot fine.

The opencores,or1200-rtlsvn481 cpu node is in the or1ksim device tree definition. Are you sure your kernel config has this in it?

CONFIG_OPENRISC_BUILTIN_DTB="or1ksim"

Could you send your kernel config?

I have attached mine, just in case. For next-20170124

Quoted 6 lines · Stafford Horne

Hmm, I just tried your qemu branch and mine:

git at github.com:stffrdhrn/qemu.git or1k-fix-sigill

Both of them were able to boot fine.

Quoted 8 lines

The opencores,or1200-rtlsvn481 cpu node is in the or1ksim device tree definition. Are you sure your kernel config has this in it?

CONFIG_OPENRISC_BUILTIN_DTB="or1ksim"

Could you send your kernel config?

I have attached mine, just in case. For next-20170124

Curious. The entire diff between our configs is just

.config 2017-01-25 09:18:14.153999754 -0800 renamed from or-config 2017-01-24 09:14:51.918059107 -0800 +1 -1

@@ -18,7 +18,7 @@
 #
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
-CONFIG_CROSS_COMPILE="or1k-linux-musl-"
+CONFIG_CROSS_COMPILE="or1k-musl-linux-"
 # CONFIG_COMPILE_TEST is not set
 CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y

So you're saying you *do* get serial port output?

Perhaps you can just send me your kernel...

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

Quoted 6 lines · Stafford Horne

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

That was just reflex, wondering where the output went.

Quoted 2 lines

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

I think that's likely the difference. I can indeed boot your kernel.

Quoted 6 lines · Stafford Horne

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

That was just reflex, wondering where the output went.

Quoted 2 lines

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

I think that's likely the difference. I can indeed boot your kernel.

Quoted 8 lines · Richard Henderson

Quoted 6 lines · Stafford Horne

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

Quoted 6 lines

That was just reflex, wondering where the output went.

Quoted 2 lines

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

I think that's likely the difference. I can indeed boot your kernel.

Hi Richard,

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

These should work.

If all is ok with the qemu patch I sent what is the next step to get them incorporated. Do you need any help from me?

... Actually I just checked your branch on github, it looks like you are doing a few updates. Let me know if you want me to review anything.

Quoted 22 lines · Stafford Horne

Quoted 8 lines · Richard Henderson

Quoted 6 lines · Stafford Horne

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

Quoted 6 lines

That was just reflex, wondering where the output went.

Quoted 2 lines

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

I think that's likely the difference. I can indeed boot your kernel.

Hi Richard,

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

Quoted 7 lines

These should work.

If all is ok with the qemu patch I sent what is the next step to get them incorporated. Do you need any help from me?

... Actually I just checked your branch on github, it looks like you are doing a few updates. Let me know if you want me to review anything.

Yes, I've been attempting to revive a patch set from 2013 that cleans up the implementation, fixing a few other bugs in the process.

However, testing it properly has been tricky. It appears as if I'm debugging qemu and gcc simultaneously, while your gdb branch doesn't want to compile for me. So I've been limited to instruction traces from qemu, which is slow going.

If you'd like to do your own testing on my tgt-or1k-2 branch, that would be appreciated.

Quoted 31 lines · Richard Henderson

Quoted 22 lines · Stafford Horne

Quoted 8 lines · Richard Henderson

Quoted 6 lines · Stafford Horne

I just sent you a mail with a link to my kernel for download.

One thing I noticed is you passed '-append console=ttyS0' I think that does nothing on openrisc since as far as I know openrisc only gets boot params from the device tree file. I tried with and without it and got no differences.

Quoted 6 lines

That was just reflex, wondering where the output went.

Quoted 2 lines

Another thing, I am using a 'late' version of gcc built with musl cross [1] , I dont think it would make a difference, but maybe?

I think that's likely the difference. I can indeed boot your kernel.

Hi Richard,

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

Quoted 7 lines

These should work.

If all is ok with the qemu patch I sent what is the next step to get them incorporated. Do you need any help from me?

... Actually I just checked your branch on github, it looks like you are doing a few updates. Let me know if you want me to review anything.

Quoted 6 lines

Yes, I've been attempting to revive a patch set from 2013 that cleans up the implementation, fixing a few other bugs in the process.

However, testing it properly has been tricky. It appears as if I'm debugging qemu and gcc simultaneously, while your gdb branch doesn't want to compile for me. So I've been limited to instruction traces from qemu, which is slow going.

What issue are you having compiling gdb?

I compile gdb with these flags.

  ../binutils-gdb/configure --target=or1k-musl-linux \
    --prefix=$PREFIX \
    --disable-itcl \
    --disable-tk \
    --disable-tcl \
    --disable-winsup \
    --disable-gdbtk \
    --disable-libgui \
    --disable-rda \
    --disable-sid \
    --with-sysroot \
    --disable-newlib \
    --disable-libgloss \
    --disable-gas \
    --disable-ld \
    --disable-binutils \
    --disable-gprof \
    --with-system-zlib

Also, I uploaded my binaries just in case:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

My host gcc is "6.3.1 20161221", I used musl-cross and my gdb branch

https://github.com/openrisc/musl-cross.git or1k

git at github.com:stffrdhrn/binutils-gdb.git or1k-upstream

Quoted 2 lines

If you'd like to do your own testing on my tgt-or1k-2 branch, that would be appreciated.

I will have a look tomorrow if I can.

I tried your tgt-or1k-2 branch with my latest kernel and have no issues.

What issue are you having compiling gdb?

[ qemu lists trimed ]

Quoted 1 line · Stafford Horne

What issue are you having compiling gdb?

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:589:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:574:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:649:
undefined reference to `or1k32bf_rfe'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:730:
undefined reference to `or1k32bf_mfspr'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:748:
undefined reference to `or1k32bf_mtspr'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1717:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1681:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1643:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1511:
undefined reference to `or1k32bf_exception'

/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1463:
undefined reference to `or1k32bf_exception'

../sim/or1k/libsim.a(mloop32.o):/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32-switch.c:1416:
more undefined references to `or1k32bf_exception' follow
../sim/or1k/libsim.a(sem32.o): In function `or1k32bf_sem_l_mtspr':
/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32.c:635:
undefined reference to `or1k32bf_mtspr'
../sim/or1k/libsim.a(sem32.o): In function `or1k32bf_sem_l_mfspr':
/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32.c:615:
undefined reference to `or1k32bf_mfspr'
../sim/or1k/libsim.a(sem32.o): In function `or1k32bf_sem_l_rfe':
/home/rth/work/gcc/bld-or/sim/or1k/../../../comb-or/sim/or1k/sem32.c:526:
undefined reference to `or1k32bf_rfe'
collect2: error: ld returned 1 exit status

r~

Could you send your bld-or/config.log? At least the first 10 lines?

Also which branch are you using to build?

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

These should work.

Quoted 5 lines · Stafford Horne

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

These should work.

This gdb crashes on the first "stepi" that I issue. To reproduce,

$ cat z.c
int main() { return 0; }
$ or1k-musl-linux-gcc -g z.c
$ qemu-or32 -g 10001 ./a.out

// another window

$ or1k-musl-linux-gdb ./a.out
(gdb) target remote localhost:10001
// should see that the pc is at _start
(gdb) stepi
// crash

I won't be able to debug this myself until I can build my own gdb.

Quoted 16 lines · Richard Henderson

Quoted 5 lines · Stafford Horne

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

These should work.

This gdb crashes on the first "stepi" that I issue. To reproduce,

$ cat z.c
int main() { return 0; }
$ or1k-musl-linux-gcc -g z.c
$ qemu-or32 -g 10001 ./a.out

// another window

Quoted 7 lines

$ or1k-musl-linux-gdb ./a.out
(gdb) target remote localhost:10001
// should see that the pc is at _start
(gdb) stepi
// crash

I won't be able to debug this myself until I can build my own gdb.

Hello,

The gdb branch I use is the following, it is tracking very close to upsstream:

git at github.com:stffrdhrn/binutils-gdb.git or1k-upstream

I have sent this for review to the gdb list and currently waiting on comments for version 4. Most of the code is the same as in openrisc github. However, I have just rebased and cleaned up for upstreaming.

Note, I can get basic programs running fine on your qemu branch using linux-user i.e.

 $ cat main.c
   #include <stdio.h>

   int main() {
     printf("hello");
     return 0;
   }
 $ or1k-linux-musl-gcc -g -static main.c
 $ ./qemu/build/or32-linux-user/qemu-or32 ./a.out
   hello

However, when debugging I ran into a few errors.

1. qemu aborts the program and sends SIGILL to gdb, this is caused by the openrisc loop in linux-user missing handlers for EXCP_INTERRUPT and EXCP_DEBUG, I patched that see below:
2. After patching I got 1 step to work then gdb crashes with SIGSEGV Currently looking at it, Interestingly the code that is failing is

in gdb/or1k-tdep.c: or1k_single_step_through_delay() cgen_lookup_insn() - returns NULL (shouldnt happen though) then NULL is dereferenced

Interesting because it seems you wrote cgen_lookup_insn :) I am investigating more, but it seems like gdb issue.

Notes on the debugger:
- The support for linux user processes is not implemented. Eventually I think it will crash somewhere. But it shouldnt crash where it is.
- I tested the same program with the baremetal (newlib) toolchain
* gdb native sim - OK can debug
* or1ksim (via target remote) - Crashes same as QEMU

Quoted 16 lines · Richard Henderson

Quoted 5 lines · Stafford Horne

For kernel builds I have created toolchain binaries here:

http://shorne.noip.me/crosstool/files/bin/x86_64/5.4.0/

These should work.

This gdb crashes on the first "stepi" that I issue. To reproduce,

$ cat z.c
int main() { return 0; }
$ or1k-musl-linux-gcc -g z.c
$ qemu-or32 -g 10001 ./a.out

// another window

Quoted 7 lines

$ or1k-musl-linux-gdb ./a.out
(gdb) target remote localhost:10001
// should see that the pc is at _start
(gdb) stepi
// crash

I won't be able to debug this myself until I can build my own gdb.

Hello,

The gdb branch I use is the following, it is tracking very close to upsstream:

git at github.com:stffrdhrn/binutils-gdb.git or1k-upstream

I have sent this for review to the gdb list and currently waiting on comments for version 4. Most of the code is the same as in openrisc github. However, I have just rebased and cleaned up for upstreaming.

However, when debugging I ran into a few errors.

1. qemu aborts the program and sends SIGILL to gdb, this is caused by the openrisc loop in linux-user missing handlers for EXCP_INTERRUPT and EXCP_DEBUG, I patched that see below: