Re: [Qemu-devel] [PATCH] Add MIPS ELF loader

Re: [Qemu-devel] [PATCH] Add MIPS ELF loader

[Marius Groeger]

Hi Alex,

> I've written to the qemu-devel list, no answers.

I copied the list.

> You could find my qemu.log there:
> http://www.nwpi.ru/~alec/mips/qemu_log.txt
> It goes into infinity exception loop. The command string was

I'm not quite sure why but you're getting a RI exception on the 
address 0xbfc00008 wich is the "move k0, zero" in the delay slot. I 
don't see a problem in the code, but have you tried this sequence?

   move k0, zero
   j	   0xbfc00400
   nop

Marius

-- 
Marius Groeger <mgroeger@sysgo.com>
SYSGO AG                      Embedded and Real-Time Software
Voice: +49 6136 9948 0                  FAX: +49 6136 9948 10
www.sysgo.com | www.elinos.com | www.osek.de | www.pikeos.com

Re: [Qemu-devel] [PATCH] Add MIPS ELF loader

[Thiemo Seufer]

Marius Groeger wrote:
> Hi Alex,
> 
> >I've written to the qemu-devel list, no answers.
> 
> I copied the list.
> 
> >You could find my qemu.log there:
> >http://www.nwpi.ru/~alec/mips/qemu_log.txt
> >It goes into infinity exception loop. The command string was
> 
> I'm not quite sure why but you're getting a RI exception on the 
> address 0xbfc00008 wich is the "move k0, zero" in the delay slot. I 
> don't see a problem in the code, but have you tried this sequence?
> 
>   move k0, zero
>   j	   0xbfc00400
>   nop

Is the move implemented as addiu or as daddiu? The latter would RI.


Thiemo

Re: [Qemu-devel] [PATCH] Add MIPS ELF loader

[Alexander Voropay]

"Thiemo Seufer" <ths@networkno.de> wrote:

>> >You could find my qemu.log there:
>> >http://www.nwpi.ru/~alec/mips/qemu_log.txt
>> >It goes into infinity exception loop. 
>> 
>> I'm not quite sure why but you're getting a RI exception on the 
>> address 0xbfc00008 wich is the "move k0, zero" in the delay slot. I 
>> don't see a problem in the code, but have you tried this sequence?
>> 
>>   move k0, zero
>>   j    0xbfc00400
>>   nop
> 
> Is the move implemented as addiu or as daddiu? The latter would RI.

 Oh! It was daddu (gcc -mips3) opcode.

 Thank you!

 Can someone add a path to make a log more readable (exception cause decode).

 The disassembler should be improved too, to mark a 64-bit opcodes as invalid
for MIPS32...

--
-=AV=-

Re: [Qemu-devel] [PATCH] Add MIPS ELF loader

[Alexander Voropay]

>>>   move k0, zero
>>>   j    0xbfc00400
>>>   nop
>> 
>> Is the move implemented as addiu or as daddiu? The latter would RI.
> 
> Oh! It was daddu (gcc -mips3) opcode.

 Another issue:

mtc0  zero, C0_CAUSE

===============
IN:
0xbfc00424:  mtc0       zero,$13

OP:
0x0000: save_pc 0xbfc00424
0x0001: raise_exception 0x11
0x0002: reset_T0
0x0003: exit_tb
0x0004: end

---------------- 3 00000000
OUT: [size=24]
0x08a96a90:  movl   $0xbfc00424,0x80(%ebp)
0x08a96a9a:  push   $0x11
0x08a96a9f:  call   0x8080fe8
0x08a96aa4:  pop    %eax
0x08a96aa5:  xor    %ebx,%ebx
0x08a96aa7:  ret

do_raise_exception_err: 17 0
do_interrupt enter: PC bfc00424 EPC 00000000 cause -1 excp 17
do_interrupt: PC bfc00380 EPC bfc00424 cause 11 excp 17
    S 00400000 C 0000042c A 00000000 D 00000000
------------------------------------------------
pc=0xbfc00380 HI=0x00000000 LO=0x00000000 ds 0004 00000000 0
GPR00: r0 00000000 at 00400000 v0 00400000 v1 00000000
GPR04: a0 00000000 a1 00000000 a2 00000000 a3 00000000
GPR08: t0 00018000 t1 00000000 t2 00000000 t3 00000000
GPR12: t4 00000000 t5 00000000 t6 00000000 t7 00000000
GPR16: s0 00000000 s1 00000000 s2 00000000 s3 00000000
GPR20: s4 00000000 s5 00000000 s6 00000000 s7 00000000
GPR24: t8 00000000 t9 00000000 k0 00000000 k1 00000000
GPR28: gp 00000000 sp 00000000 s8 00000000 ra 00000000
CP0 Status  0x00400002 Cause   0x0000042c EPC    0xbfc00424
    Config0 0x80008090 Config1 0x1e190c8a LLAddr 0x00000000
IN:
0xbfc00380:  j  0xbfc019c0

Re: [Qemu-devel] CP0 after reset bug (Was: Add MIPS ELF loader)

[Alexander Voropay]

"Alexander Voropay" <a.voropay@equant.ru> wrote:

> Another issue:
> 
> IN:
> 0xbfc00424:  mtc0       zero,$13
> 0x0001: raise_exception 0x11

 The problem is a code *before* this :
==========
        mfc0    v0,C0_SR
        and     v0,SR_SR                # preserve Soft Reset
        or      v0,SR_BEV               # set Boot Exceptions

        mtc0    v0,C0_SR                # 32 bit, kernel mode, bootstrap
        mtc0    zero,C0_CAUSE     # <-- TRAP there !!!
==========

 This code is a cut'n'paste from the "See MIPS Run" p.338

 Unfortunately, this code clears CU0  bits in the CP0(SR).
It makes CP0 unusable for program and causes an exception 11 :
Coprocessor Unusable on the next CP0 access.

 The Qemu has a bug there. The "See MIPS Run" p.51 states:

CU0 - Coprocessor 0 usable; Set 1 to be able to use some nominally
priveleged instructions in the user mode. You don't want to do this.
The CPU control instructions encoded as coprocessor 0 type are
always usable in kernel mode, regardless of the setting of this bit.

 Qemu does simply check:
./target-mips/translate.c:1181
===================
    if (!(ctx->CP0_Status & (1 << CP0St_CU0)) &&
        !(ctx->hflags & MIPS_HFLAG_UM) &&
        !(ctx->hflags & MIPS_HFLAG_ERL) &&
        !(ctx->hflags & MIPS_HFLAG_EXL)) {
        if (loglevel & CPU_LOG_TB_IN_ASM) {
            fprintf(logfile, "CP0 is not usable\n");
        }
        generate_exception_err (ctx, EXCP_CpU, 0);
        return;
===================

 This check is not enought to emulate a Coprocessor Unusable
situation on Reset (when CPU is in the kernel mode).

--
-=AV=-

Re: [Qemu-devel] CP0 after reset bug (Was: Add MIPS ELF loader)

[Thiemo Seufer]

Alexander Voropay wrote:
[snip]
> Unfortunately, this code clears CU0  bits in the CP0(SR).
> It makes CP0 unusable for program and causes an exception 11 :
> Coprocessor Unusable on the next CP0 access.
> 
> The Qemu has a bug there. The "See MIPS Run" p.51 states:
> 
> CU0 - Coprocessor 0 usable; Set 1 to be able to use some nominally
> priveleged instructions in the user mode. You don't want to do this.
> The CPU control instructions encoded as coprocessor 0 type are
> always usable in kernel mode, regardless of the setting of this bit.
> 
> Qemu does simply check:
> ./target-mips/translate.c:1181
> ===================
>    if (!(ctx->CP0_Status & (1 << CP0St_CU0)) &&
>        !(ctx->hflags & MIPS_HFLAG_UM) &&
>        !(ctx->hflags & MIPS_HFLAG_ERL) &&
>        !(ctx->hflags & MIPS_HFLAG_EXL)) {
>        if (loglevel & CPU_LOG_TB_IN_ASM) {
>            fprintf(logfile, "CP0 is not usable\n");
>        }
>        generate_exception_err (ctx, EXCP_CpU, 0);
>        return;
> ===================
> 
> This check is not enought to emulate a Coprocessor Unusable
> situation on Reset (when CPU is in the kernel mode).

A patch which doesn't negate the HFLAGS_UM check fixes this and was
posted here a while ago.


Thiemo

Re: [Qemu-devel] CP0 after reset bug (Was: Add MIPS ELF loader)

[Alexander Voropay]

"Thiemo Seufer" <ths@networkno.de> wrote:

>> The Qemu has a bug there. The "See MIPS Run" p.51 states:
> A patch which doesn't negate the HFLAGS_UM check fixes this and was
> posted here a while ago.

 Thx, found.
http://lists.gnu.org/archive/html/qemu-devel/2006-03/msg00148.html

 Is it possible to push it into the CVS ?

--
-=AV=-