[Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Palmer Dabbelt]

The following changes since commit 49fc899f8d673dd9e73f3db0d9e9ea60b77c331b:

  Update version for v4.0.0-rc1 release (2019-03-26 17:02:29 +0000)

are available in the Git repository at:

  git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3

for you to fetch changes up to b84ffcecdb7a6a3e9946d0d6d24703199c4880b3:

  riscv: plic: Log guest errors (2019-03-27 20:23:03 -0700)

----------------------------------------------------------------
RISC-V Patches for 4.0-rc3

This patch set contains a pair of tightly coupled PLIC bug fixes:

* We were calculating the PLIC addresses incorrectly.
* We were installing the wrong number of PLIC interrupts.

The two bugs togther resulted in a mostly-working system, but they're
impossible to seperate because fixing one bug would result in
significant breakage.  As a result they're in the same patch.

There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
error reporting.

As far as I know these are the last outstanding RISC-V patches for 4.0.

----------------------------------------------------------------
Alistair Francis (2):
      riscv: plic: Fix incorrect irq calculation
      riscv: plic: Log guest errors

 hw/riscv/sifive_plic.c      | 16 +++++++++++-----
 hw/riscv/sifive_u.c         |  2 +-
 include/hw/riscv/sifive_e.h |  2 +-
 include/hw/riscv/sifive_u.h |  4 ++--
 include/hw/riscv/virt.h     |  2 +-
 5 files changed, 16 insertions(+), 10 deletions(-)

[Qemu-devel] [PULL 1/2] riscv: plic: Fix incorrect irq calculation

[Palmer Dabbelt]

From: Alistair Francis <Alistair.Francis@wdc.com>

This patch fixes four different things, to maintain bisectability they
have been merged into a single patch. The following fixes are below:

sifive_plic: Fix incorrect irq calculation
The irq is incorrectly calculated to be off by one. It has worked in the
past as the priority_base offset has also been set incorrectly. We are
about to fix the priority_base offset so first first the irq
calculation.

sifive_u: Fix PLIC priority base offset and numbering
According to the FU540 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00. The same manual also specifies that the
PLIC only has 53 source priorities. Fix these two incorrect header
files.

We also need to over extend the plic_gpios[] array as the PLIC sources
count from 1 and not 0.

riscv: sifive_e: Fix PLIC priority base offset
According to the FE31 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00.

riscv: virt: Fix PLIC priority base offset
Update the virt offsets based on the newly updated SiFive U and SiFive E
offsets.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Palmer Dabbelt <palmer@sifive.com>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
---
 hw/riscv/sifive_plic.c      | 4 ++--
 hw/riscv/sifive_u.c         | 2 +-
 include/hw/riscv/sifive_e.h | 2 +-
 include/hw/riscv/sifive_u.h | 4 ++--
 include/hw/riscv/virt.h     | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index 1c703e1a376a..70a85cd07578 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -206,7 +206,7 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: read priority: irq=%d priority=%d\n",
                 irq, plic->source_priority[irq]);
@@ -279,7 +279,7 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         plic->source_priority[irq] = value & 7;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: write priority: irq=%d priority=%d\n",
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 5ecc47cea35d..88381a750776 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -340,7 +340,7 @@ static void riscv_sifive_u_soc_realize(DeviceState *dev, Error **errp)
     const struct MemmapEntry *memmap = sifive_u_memmap;
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
-    qemu_irq plic_gpios[SIFIVE_U_PLIC_NUM_SOURCES];
+    qemu_irq plic_gpios[SIFIVE_U_PLIC_NUM_SOURCES + 1];
     int i;
     Error *err = NULL;
     NICInfo *nd = &nd_table[0];
diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index 7b6d8aed968f..f715f8606fa6 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -70,7 +70,7 @@ enum {
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
 #define SIFIVE_E_PLIC_NUM_SOURCES 127
 #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_E_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_E_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_E_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index be13cc1304cc..d859ea20f6a2 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -68,9 +68,9 @@ enum {
 };
 
 #define SIFIVE_U_PLIC_HART_CONFIG "MS"
-#define SIFIVE_U_PLIC_NUM_SOURCES 127
+#define SIFIVE_U_PLIC_NUM_SOURCES 53
 #define SIFIVE_U_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_U_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_U_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_U_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_U_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_U_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index f12deaebd697..568764b57088 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -59,7 +59,7 @@ enum {
 #define VIRT_PLIC_HART_CONFIG "MS"
 #define VIRT_PLIC_NUM_SOURCES 127
 #define VIRT_PLIC_NUM_PRIORITIES 7
-#define VIRT_PLIC_PRIORITY_BASE 0x0
+#define VIRT_PLIC_PRIORITY_BASE 0x04
 #define VIRT_PLIC_PENDING_BASE 0x1000
 #define VIRT_PLIC_ENABLE_BASE 0x2000
 #define VIRT_PLIC_ENABLE_STRIDE 0x80
-- 
2.19.2

[Qemu-devel] [PULL 2/2] riscv: plic: Log guest errors

[Palmer Dabbelt]

From: Alistair Francis <Alistair.Francis@wdc.com>

Instead of using error_report() to print guest errors let's use
qemu_log_mask(LOG_GUEST_ERROR,...) to log the error.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Palmer Dabbelt <palmer@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
---
 hw/riscv/sifive_plic.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index 70a85cd07578..7f373d6c9d2c 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -262,7 +262,9 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
     }
 
 err:
-    error_report("plic: invalid register read: %08x", (uint32_t)addr);
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
+                  __func__, addr);
     return 0;
 }
 
@@ -289,7 +291,9 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
     } else if (addr >= plic->pending_base && /* 1 bit per source */
                addr < plic->pending_base + (plic->num_sources >> 3))
     {
-        error_report("plic: invalid pending write: %08x", (uint32_t)addr);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid pending write: 0x%" HWADDR_PRIx "",
+                      __func__, addr);
         return;
     } else if (addr >= plic->enable_base && /* 1 bit per source */
         addr < plic->enable_base + plic->num_addrs * plic->enable_stride)
@@ -339,7 +343,9 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
     }
 
 err:
-    error_report("plic: invalid register write: %08x", (uint32_t)addr);
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
+                  __func__, addr);
 }
 
 static const MemoryRegionOps sifive_plic_ops = {
-- 
2.19.2

Re: [Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Peter Maydell]

On Thu, 4 Apr 2019 at 08:00, Palmer Dabbelt <palmer@sifive.com> wrote:
>
> The following changes since commit 49fc899f8d673dd9e73f3db0d9e9ea60b77c331b:
>
>   Update version for v4.0.0-rc1 release (2019-03-26 17:02:29 +0000)
>
> are available in the Git repository at:
>
>   git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3
>
> for you to fetch changes up to b84ffcecdb7a6a3e9946d0d6d24703199c4880b3:
>
>   riscv: plic: Log guest errors (2019-03-27 20:23:03 -0700)
>
> ----------------------------------------------------------------
> RISC-V Patches for 4.0-rc3
>
> This patch set contains a pair of tightly coupled PLIC bug fixes:
>
> * We were calculating the PLIC addresses incorrectly.
> * We were installing the wrong number of PLIC interrupts.
>
> The two bugs togther resulted in a mostly-working system, but they're
> impossible to seperate because fixing one bug would result in
> significant breakage.  As a result they're in the same patch.
>
> There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
> error reporting.
>
> As far as I know these are the last outstanding RISC-V patches for 4.0.

Hi; I'm afraid this fails 'make check':
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}
QTEST_QEMU_BINARY=riscv32-softmmu/qemu-system-riscv32
QTEST_QEMU_IMG=qemu-img tests/qom-test -m=quick -k --tap < /dev/null |
./scripts/tap-driver.pl --test-name="qom-test"
PASS 1 qom-test /riscv32/qom/virt
PASS 2 qom-test /riscv32/qom/none
PASS 3 qom-test /riscv32/qom/spike_v1.10
Broken pipe
/home/petmay01/linaro/qemu-for-merges/tests/libqtest.c:143:
kill_qemu() detected QEMU death from signal 11 (Segmentation fault)
(core dumped)
Aborted (core dumped)
ERROR - too few tests run (expected 6, got 3)
/home/petmay01/linaro/qemu-for-merges/tests/Makefile.include:903:
recipe for target 'check-qtest-riscv32' failed

The sifive_u machine seems to dump core on startup:

$ gdb --args riscv32-softmmu/qemu-system-riscv32 -M sifive_u -display none
[...]
(gdb) r
Starting program:
/home/petmay01/linaro/qemu-for-merges/build/alldbg/riscv32-softmmu/qemu-system-riscv32
-M sifive_u -display none
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffd7dc4700 (LWP 29908)]
[New Thread 0x7fffd526f700 (LWP 29909)]

Thread 1 "qemu-system-ris" received signal SIGSEGV, Segmentation fault.
0x0000555555ba1df7 in object_get_canonical_path_component
(obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
1797        g_hash_table_iter_init(&iter, obj->parent->properties);
(gdb) bt
#0  0x0000555555ba1df7 in object_get_canonical_path_component
(obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
#1  0x0000555555ba1ed6 in object_get_canonical_path
(obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:1823
#2  0x0000555555ba0b72 in object_property_set_link
(obj=0x5555567e2e50, value=0x5555559b3018
<qdev_get_hotplug_handler+24>, name=0x555556919b60 "sysbus-irq[0]",
errp=0x5555566b6d28 <error_abort>)
    at /home/petmay01/linaro/qemu-for-merges/qom/object.c:1302
#3  0x00005555559b37f4 in qdev_connect_gpio_out_named
(dev=0x5555567e2e50, name=0x555555e52b62 "sysbus-irq", n=0,
pin=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
/home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:460
#4  0x00005555559b9d7b in sysbus_connect_irq (dev=0x5555567e2e50, n=0,
irq=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
/home/petmay01/linaro/qemu-for-merges/hw/core/sysbus.c:116
#5  0x000055555590a9e9 in riscv_sifive_u_soc_realize
(dev=0x5555567e2820, errp=0x7fffffffdc80) at
/home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:393
#6  0x00005555559b457e in device_set_realized (obj=0x5555567e2820,
value=true, errp=0x5555566b6d28 <error_abort>) at
/home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:834
#7  0x0000555555ba276a in property_set_bool (obj=0x5555567e2820,
v=0x5555567e9360, name=0x555555e28139 "realized",
opaque=0x5555567e1220, errp=0x5555566b6d28 <error_abort>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:2074
#8  0x0000555555ba09e6 in object_property_set (obj=0x5555567e2820,
v=0x5555567e9360, name=0x555555e28139 "realized", errp=0x5555566b6d28
<error_abort>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:1266
#9  0x0000555555ba3aac in object_property_set_qobject
(obj=0x5555567e2820, value=0x5555567e9340, name=0x555555e28139
"realized", errp=0x5555566b6d28 <error_abort>) at
/home/petmay01/linaro/qemu-for-merges/qom/qom-qobject.c:27
#10 0x0000555555ba0ccb in object_property_set_bool
(obj=0x5555567e2820, value=true, name=0x555555e28139 "realized",
errp=0x5555566b6d28 <error_abort>) at
/home/petmay01/linaro/qemu-for-merges/qom/object.c:1332
#11 0x000055555590a1f3 in riscv_sifive_u_init (machine=0x55555671b8d0)
at /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:270
#12 0x00005555559bcfa8 in machine_run_board_init
(machine=0x55555671b8d0) at
/home/petmay01/linaro/qemu-for-merges/hw/core/machine.c:1030
#13 0x00005555559406fd in main (argc=5, argv=0x7fffffffe1d8,
envp=0x7fffffffe208) at
/home/petmay01/linaro/qemu-for-merges/vl.c:4479


Running under valgrind shows use of uninitialised values, invalid reads, etc:

==29912== Conditional jump or move depends on uninitialised value(s)
==29912==    at 0x5677A8: qdev_connect_gpio_out_named (qdev.c:450)
==29912==    by 0x56DD7A: sysbus_connect_irq (sysbus.c:116)
==29912==    by 0x4BE9E8: riscv_sifive_u_soc_realize (sifive_u.c:393)
==29912==    by 0x56857D: device_set_realized (qdev.c:834)
==29912==    by 0x756769: property_set_bool (object.c:2074)
==29912==    by 0x7549E5: object_property_set (object.c:1266)
==29912==    by 0x757AAB: object_property_set_qobject (qom-qobject.c:27)
==29912==    by 0x754CCA: object_property_set_bool (object.c:1332)
==29912==    by 0x4BE1F2: riscv_sifive_u_init (sifive_u.c:270)
==29912==    by 0x570FA7: machine_run_board_init (machine.c:1030)
==29912==    by 0x4F46FC: main (vl.c:4479)


thanks
-- PMM

Re: [Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Alistair Francis]

On Thu, Apr 4, 2019 at 1:45 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Thu, 4 Apr 2019 at 08:00, Palmer Dabbelt <palmer@sifive.com> wrote:
> >
> > The following changes since commit 49fc899f8d673dd9e73f3db0d9e9ea60b77c331b:
> >
> >   Update version for v4.0.0-rc1 release (2019-03-26 17:02:29 +0000)
> >
> > are available in the Git repository at:
> >
> >   git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3
> >
> > for you to fetch changes up to b84ffcecdb7a6a3e9946d0d6d24703199c4880b3:
> >
> >   riscv: plic: Log guest errors (2019-03-27 20:23:03 -0700)
> >
> > ----------------------------------------------------------------
> > RISC-V Patches for 4.0-rc3
> >
> > This patch set contains a pair of tightly coupled PLIC bug fixes:
> >
> > * We were calculating the PLIC addresses incorrectly.
> > * We were installing the wrong number of PLIC interrupts.
> >
> > The two bugs togther resulted in a mostly-working system, but they're
> > impossible to seperate because fixing one bug would result in
> > significant breakage.  As a result they're in the same patch.
> >
> > There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
> > error reporting.
> >
> > As far as I know these are the last outstanding RISC-V patches for 4.0.
>
> Hi; I'm afraid this fails 'make check':
> MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}
> QTEST_QEMU_BINARY=riscv32-softmmu/qemu-system-riscv32
> QTEST_QEMU_IMG=qemu-img tests/qom-test -m=quick -k --tap < /dev/null |
> ./scripts/tap-driver.pl --test-name="qom-test"
> PASS 1 qom-test /riscv32/qom/virt
> PASS 2 qom-test /riscv32/qom/none
> PASS 3 qom-test /riscv32/qom/spike_v1.10
> Broken pipe
> /home/petmay01/linaro/qemu-for-merges/tests/libqtest.c:143:
> kill_qemu() detected QEMU death from signal 11 (Segmentation fault)
> (core dumped)
> Aborted (core dumped)
> ERROR - too few tests run (expected 6, got 3)
> /home/petmay01/linaro/qemu-for-merges/tests/Makefile.include:903:
> recipe for target 'check-qtest-riscv32' failed

I managed to reproduce the problem and I have sent a v3 with the fix.

What is strange is that I didn't see this in my make check runs, I'll
check to see what I'm missing.

What is also strange is that the SiFive U machine should only be
64-bit, it seems odd to run it with 32-bit RISC-V (unless I'm missing
something). That's probably something we should fix for 4.1.

Alistair

>
> The sifive_u machine seems to dump core on startup:
>
> $ gdb --args riscv32-softmmu/qemu-system-riscv32 -M sifive_u -display none
> [...]
> (gdb) r
> Starting program:
> /home/petmay01/linaro/qemu-for-merges/build/alldbg/riscv32-softmmu/qemu-system-riscv32
> -M sifive_u -display none
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> [New Thread 0x7fffd7dc4700 (LWP 29908)]
> [New Thread 0x7fffd526f700 (LWP 29909)]
>
> Thread 1 "qemu-system-ris" received signal SIGSEGV, Segmentation fault.
> 0x0000555555ba1df7 in object_get_canonical_path_component
> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
> 1797        g_hash_table_iter_init(&iter, obj->parent->properties);
> (gdb) bt
> #0  0x0000555555ba1df7 in object_get_canonical_path_component
> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
> #1  0x0000555555ba1ed6 in object_get_canonical_path
> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1823
> #2  0x0000555555ba0b72 in object_property_set_link
> (obj=0x5555567e2e50, value=0x5555559b3018
> <qdev_get_hotplug_handler+24>, name=0x555556919b60 "sysbus-irq[0]",
> errp=0x5555566b6d28 <error_abort>)
>     at /home/petmay01/linaro/qemu-for-merges/qom/object.c:1302
> #3  0x00005555559b37f4 in qdev_connect_gpio_out_named
> (dev=0x5555567e2e50, name=0x555555e52b62 "sysbus-irq", n=0,
> pin=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:460
> #4  0x00005555559b9d7b in sysbus_connect_irq (dev=0x5555567e2e50, n=0,
> irq=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
> /home/petmay01/linaro/qemu-for-merges/hw/core/sysbus.c:116
> #5  0x000055555590a9e9 in riscv_sifive_u_soc_realize
> (dev=0x5555567e2820, errp=0x7fffffffdc80) at
> /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:393
> #6  0x00005555559b457e in device_set_realized (obj=0x5555567e2820,
> value=true, errp=0x5555566b6d28 <error_abort>) at
> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:834
> #7  0x0000555555ba276a in property_set_bool (obj=0x5555567e2820,
> v=0x5555567e9360, name=0x555555e28139 "realized",
> opaque=0x5555567e1220, errp=0x5555566b6d28 <error_abort>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:2074
> #8  0x0000555555ba09e6 in object_property_set (obj=0x5555567e2820,
> v=0x5555567e9360, name=0x555555e28139 "realized", errp=0x5555566b6d28
> <error_abort>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1266
> #9  0x0000555555ba3aac in object_property_set_qobject
> (obj=0x5555567e2820, value=0x5555567e9340, name=0x555555e28139
> "realized", errp=0x5555566b6d28 <error_abort>) at
> /home/petmay01/linaro/qemu-for-merges/qom/qom-qobject.c:27
> #10 0x0000555555ba0ccb in object_property_set_bool
> (obj=0x5555567e2820, value=true, name=0x555555e28139 "realized",
> errp=0x5555566b6d28 <error_abort>) at
> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1332
> #11 0x000055555590a1f3 in riscv_sifive_u_init (machine=0x55555671b8d0)
> at /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:270
> #12 0x00005555559bcfa8 in machine_run_board_init
> (machine=0x55555671b8d0) at
> /home/petmay01/linaro/qemu-for-merges/hw/core/machine.c:1030
> #13 0x00005555559406fd in main (argc=5, argv=0x7fffffffe1d8,
> envp=0x7fffffffe208) at
> /home/petmay01/linaro/qemu-for-merges/vl.c:4479
>
>
> Running under valgrind shows use of uninitialised values, invalid reads, etc:
>
> ==29912== Conditional jump or move depends on uninitialised value(s)
> ==29912==    at 0x5677A8: qdev_connect_gpio_out_named (qdev.c:450)
> ==29912==    by 0x56DD7A: sysbus_connect_irq (sysbus.c:116)
> ==29912==    by 0x4BE9E8: riscv_sifive_u_soc_realize (sifive_u.c:393)
> ==29912==    by 0x56857D: device_set_realized (qdev.c:834)
> ==29912==    by 0x756769: property_set_bool (object.c:2074)
> ==29912==    by 0x7549E5: object_property_set (object.c:1266)
> ==29912==    by 0x757AAB: object_property_set_qobject (qom-qobject.c:27)
> ==29912==    by 0x754CCA: object_property_set_bool (object.c:1332)
> ==29912==    by 0x4BE1F2: riscv_sifive_u_init (sifive_u.c:270)
> ==29912==    by 0x570FA7: machine_run_board_init (machine.c:1030)
> ==29912==    by 0x4F46FC: main (vl.c:4479)
>
>
> thanks
> -- PMM

Re: [Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Palmer Dabbelt]

On Thu, 04 Apr 2019 11:18:52 PDT (-0700), alistair23@gmail.com wrote:
> On Thu, Apr 4, 2019 at 1:45 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>>
>> On Thu, 4 Apr 2019 at 08:00, Palmer Dabbelt <palmer@sifive.com> wrote:
>> >
>> > The following changes since commit 49fc899f8d673dd9e73f3db0d9e9ea60b77c331b:
>> >
>> >   Update version for v4.0.0-rc1 release (2019-03-26 17:02:29 +0000)
>> >
>> > are available in the Git repository at:
>> >
>> >   git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3
>> >
>> > for you to fetch changes up to b84ffcecdb7a6a3e9946d0d6d24703199c4880b3:
>> >
>> >   riscv: plic: Log guest errors (2019-03-27 20:23:03 -0700)
>> >
>> > ----------------------------------------------------------------
>> > RISC-V Patches for 4.0-rc3
>> >
>> > This patch set contains a pair of tightly coupled PLIC bug fixes:
>> >
>> > * We were calculating the PLIC addresses incorrectly.
>> > * We were installing the wrong number of PLIC interrupts.
>> >
>> > The two bugs togther resulted in a mostly-working system, but they're
>> > impossible to seperate because fixing one bug would result in
>> > significant breakage.  As a result they're in the same patch.
>> >
>> > There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
>> > error reporting.
>> >
>> > As far as I know these are the last outstanding RISC-V patches for 4.0.
>>
>> Hi; I'm afraid this fails 'make check':
>> MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}
>> QTEST_QEMU_BINARY=riscv32-softmmu/qemu-system-riscv32
>> QTEST_QEMU_IMG=qemu-img tests/qom-test -m=quick -k --tap < /dev/null |
>> ./scripts/tap-driver.pl --test-name="qom-test"
>> PASS 1 qom-test /riscv32/qom/virt
>> PASS 2 qom-test /riscv32/qom/none
>> PASS 3 qom-test /riscv32/qom/spike_v1.10
>> Broken pipe
>> /home/petmay01/linaro/qemu-for-merges/tests/libqtest.c:143:
>> kill_qemu() detected QEMU death from signal 11 (Segmentation fault)
>> (core dumped)
>> Aborted (core dumped)
>> ERROR - too few tests run (expected 6, got 3)
>> /home/petmay01/linaro/qemu-for-merges/tests/Makefile.include:903:
>> recipe for target 'check-qtest-riscv32' failed
>
> I managed to reproduce the problem and I have sent a v3 with the fix.
>
> What is strange is that I didn't see this in my make check runs, I'll
> check to see what I'm missing.

Thanks!

> What is also strange is that the SiFive U machine should only be
> 64-bit, it seems odd to run it with 32-bit RISC-V (unless I'm missing
> something). That's probably something we should fix for 4.1.

Ya, we need to go clean this up.  It's all a bit messy right now.

>
> Alistair
>
>>
>> The sifive_u machine seems to dump core on startup:
>>
>> $ gdb --args riscv32-softmmu/qemu-system-riscv32 -M sifive_u -display none
>> [...]
>> (gdb) r
>> Starting program:
>> /home/petmay01/linaro/qemu-for-merges/build/alldbg/riscv32-softmmu/qemu-system-riscv32
>> -M sifive_u -display none
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>> [New Thread 0x7fffd7dc4700 (LWP 29908)]
>> [New Thread 0x7fffd526f700 (LWP 29909)]
>>
>> Thread 1 "qemu-system-ris" received signal SIGSEGV, Segmentation fault.
>> 0x0000555555ba1df7 in object_get_canonical_path_component
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
>> 1797        g_hash_table_iter_init(&iter, obj->parent->properties);
>> (gdb) bt
>> #0  0x0000555555ba1df7 in object_get_canonical_path_component
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
>> #1  0x0000555555ba1ed6 in object_get_canonical_path
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1823
>> #2  0x0000555555ba0b72 in object_property_set_link
>> (obj=0x5555567e2e50, value=0x5555559b3018
>> <qdev_get_hotplug_handler+24>, name=0x555556919b60 "sysbus-irq[0]",
>> errp=0x5555566b6d28 <error_abort>)
>>     at /home/petmay01/linaro/qemu-for-merges/qom/object.c:1302
>> #3  0x00005555559b37f4 in qdev_connect_gpio_out_named
>> (dev=0x5555567e2e50, name=0x555555e52b62 "sysbus-irq", n=0,
>> pin=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:460
>> #4  0x00005555559b9d7b in sysbus_connect_irq (dev=0x5555567e2e50, n=0,
>> irq=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/sysbus.c:116
>> #5  0x000055555590a9e9 in riscv_sifive_u_soc_realize
>> (dev=0x5555567e2820, errp=0x7fffffffdc80) at
>> /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:393
>> #6  0x00005555559b457e in device_set_realized (obj=0x5555567e2820,
>> value=true, errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:834
>> #7  0x0000555555ba276a in property_set_bool (obj=0x5555567e2820,
>> v=0x5555567e9360, name=0x555555e28139 "realized",
>> opaque=0x5555567e1220, errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:2074
>> #8  0x0000555555ba09e6 in object_property_set (obj=0x5555567e2820,
>> v=0x5555567e9360, name=0x555555e28139 "realized", errp=0x5555566b6d28
>> <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1266
>> #9  0x0000555555ba3aac in object_property_set_qobject
>> (obj=0x5555567e2820, value=0x5555567e9340, name=0x555555e28139
>> "realized", errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/qom-qobject.c:27
>> #10 0x0000555555ba0ccb in object_property_set_bool
>> (obj=0x5555567e2820, value=true, name=0x555555e28139 "realized",
>> errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1332
>> #11 0x000055555590a1f3 in riscv_sifive_u_init (machine=0x55555671b8d0)
>> at /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:270
>> #12 0x00005555559bcfa8 in machine_run_board_init
>> (machine=0x55555671b8d0) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/machine.c:1030
>> #13 0x00005555559406fd in main (argc=5, argv=0x7fffffffe1d8,
>> envp=0x7fffffffe208) at
>> /home/petmay01/linaro/qemu-for-merges/vl.c:4479
>>
>>
>> Running under valgrind shows use of uninitialised values, invalid reads, etc:
>>
>> ==29912== Conditional jump or move depends on uninitialised value(s)
>> ==29912==    at 0x5677A8: qdev_connect_gpio_out_named (qdev.c:450)
>> ==29912==    by 0x56DD7A: sysbus_connect_irq (sysbus.c:116)
>> ==29912==    by 0x4BE9E8: riscv_sifive_u_soc_realize (sifive_u.c:393)
>> ==29912==    by 0x56857D: device_set_realized (qdev.c:834)
>> ==29912==    by 0x756769: property_set_bool (object.c:2074)
>> ==29912==    by 0x7549E5: object_property_set (object.c:1266)
>> ==29912==    by 0x757AAB: object_property_set_qobject (qom-qobject.c:27)
>> ==29912==    by 0x754CCA: object_property_set_bool (object.c:1332)
>> ==29912==    by 0x4BE1F2: riscv_sifive_u_init (sifive_u.c:270)
>> ==29912==    by 0x570FA7: machine_run_board_init (machine.c:1030)
>> ==29912==    by 0x4F46FC: main (vl.c:4479)
>>
>>
>> thanks
>> -- PMM

Re: [Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3

[Palmer Dabbelt]

On Thu, 04 Apr 2019 11:18:52 PDT (-0700), alistair23@gmail.com wrote:
> On Thu, Apr 4, 2019 at 1:45 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>>
>> On Thu, 4 Apr 2019 at 08:00, Palmer Dabbelt <palmer@sifive.com> wrote:
>> >
>> > The following changes since commit 49fc899f8d673dd9e73f3db0d9e9ea60b77c331b:
>> >
>> >   Update version for v4.0.0-rc1 release (2019-03-26 17:02:29 +0000)
>> >
>> > are available in the Git repository at:
>> >
>> >   git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3
>> >
>> > for you to fetch changes up to b84ffcecdb7a6a3e9946d0d6d24703199c4880b3:
>> >
>> >   riscv: plic: Log guest errors (2019-03-27 20:23:03 -0700)
>> >
>> > ----------------------------------------------------------------
>> > RISC-V Patches for 4.0-rc3
>> >
>> > This patch set contains a pair of tightly coupled PLIC bug fixes:
>> >
>> > * We were calculating the PLIC addresses incorrectly.
>> > * We were installing the wrong number of PLIC interrupts.
>> >
>> > The two bugs togther resulted in a mostly-working system, but they're
>> > impossible to seperate because fixing one bug would result in
>> > significant breakage.  As a result they're in the same patch.
>> >
>> > There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
>> > error reporting.
>> >
>> > As far as I know these are the last outstanding RISC-V patches for 4.0.
>>
>> Hi; I'm afraid this fails 'make check':
>> MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}
>> QTEST_QEMU_BINARY=riscv32-softmmu/qemu-system-riscv32
>> QTEST_QEMU_IMG=qemu-img tests/qom-test -m=quick -k --tap < /dev/null |
>> ./scripts/tap-driver.pl --test-name="qom-test"
>> PASS 1 qom-test /riscv32/qom/virt
>> PASS 2 qom-test /riscv32/qom/none
>> PASS 3 qom-test /riscv32/qom/spike_v1.10
>> Broken pipe
>> /home/petmay01/linaro/qemu-for-merges/tests/libqtest.c:143:
>> kill_qemu() detected QEMU death from signal 11 (Segmentation fault)
>> (core dumped)
>> Aborted (core dumped)
>> ERROR - too few tests run (expected 6, got 3)
>> /home/petmay01/linaro/qemu-for-merges/tests/Makefile.include:903:
>> recipe for target 'check-qtest-riscv32' failed
>
> I managed to reproduce the problem and I have sent a v3 with the fix.
>
> What is strange is that I didn't see this in my make check runs, I'll
> check to see what I'm missing.

Thanks!

> What is also strange is that the SiFive U machine should only be
> 64-bit, it seems odd to run it with 32-bit RISC-V (unless I'm missing
> something). That's probably something we should fix for 4.1.

Ya, we need to go clean this up.  It's all a bit messy right now.

>
> Alistair
>
>>
>> The sifive_u machine seems to dump core on startup:
>>
>> $ gdb --args riscv32-softmmu/qemu-system-riscv32 -M sifive_u -display none
>> [...]
>> (gdb) r
>> Starting program:
>> /home/petmay01/linaro/qemu-for-merges/build/alldbg/riscv32-softmmu/qemu-system-riscv32
>> -M sifive_u -display none
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>> [New Thread 0x7fffd7dc4700 (LWP 29908)]
>> [New Thread 0x7fffd526f700 (LWP 29909)]
>>
>> Thread 1 "qemu-system-ris" received signal SIGSEGV, Segmentation fault.
>> 0x0000555555ba1df7 in object_get_canonical_path_component
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
>> 1797        g_hash_table_iter_init(&iter, obj->parent->properties);
>> (gdb) bt
>> #0  0x0000555555ba1df7 in object_get_canonical_path_component
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1797
>> #1  0x0000555555ba1ed6 in object_get_canonical_path
>> (obj=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1823
>> #2  0x0000555555ba0b72 in object_property_set_link
>> (obj=0x5555567e2e50, value=0x5555559b3018
>> <qdev_get_hotplug_handler+24>, name=0x555556919b60 "sysbus-irq[0]",
>> errp=0x5555566b6d28 <error_abort>)
>>     at /home/petmay01/linaro/qemu-for-merges/qom/object.c:1302
>> #3  0x00005555559b37f4 in qdev_connect_gpio_out_named
>> (dev=0x5555567e2e50, name=0x555555e52b62 "sysbus-irq", n=0,
>> pin=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:460
>> #4  0x00005555559b9d7b in sysbus_connect_irq (dev=0x5555567e2e50, n=0,
>> irq=0x5555559b3018 <qdev_get_hotplug_handler+24>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/sysbus.c:116
>> #5  0x000055555590a9e9 in riscv_sifive_u_soc_realize
>> (dev=0x5555567e2820, errp=0x7fffffffdc80) at
>> /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:393
>> #6  0x00005555559b457e in device_set_realized (obj=0x5555567e2820,
>> value=true, errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/qdev.c:834
>> #7  0x0000555555ba276a in property_set_bool (obj=0x5555567e2820,
>> v=0x5555567e9360, name=0x555555e28139 "realized",
>> opaque=0x5555567e1220, errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:2074
>> #8  0x0000555555ba09e6 in object_property_set (obj=0x5555567e2820,
>> v=0x5555567e9360, name=0x555555e28139 "realized", errp=0x5555566b6d28
>> <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1266
>> #9  0x0000555555ba3aac in object_property_set_qobject
>> (obj=0x5555567e2820, value=0x5555567e9340, name=0x555555e28139
>> "realized", errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/qom-qobject.c:27
>> #10 0x0000555555ba0ccb in object_property_set_bool
>> (obj=0x5555567e2820, value=true, name=0x555555e28139 "realized",
>> errp=0x5555566b6d28 <error_abort>) at
>> /home/petmay01/linaro/qemu-for-merges/qom/object.c:1332
>> #11 0x000055555590a1f3 in riscv_sifive_u_init (machine=0x55555671b8d0)
>> at /home/petmay01/linaro/qemu-for-merges/hw/riscv/sifive_u.c:270
>> #12 0x00005555559bcfa8 in machine_run_board_init
>> (machine=0x55555671b8d0) at
>> /home/petmay01/linaro/qemu-for-merges/hw/core/machine.c:1030
>> #13 0x00005555559406fd in main (argc=5, argv=0x7fffffffe1d8,
>> envp=0x7fffffffe208) at
>> /home/petmay01/linaro/qemu-for-merges/vl.c:4479
>>
>>
>> Running under valgrind shows use of uninitialised values, invalid reads, etc:
>>
>> ==29912== Conditional jump or move depends on uninitialised value(s)
>> ==29912==    at 0x5677A8: qdev_connect_gpio_out_named (qdev.c:450)
>> ==29912==    by 0x56DD7A: sysbus_connect_irq (sysbus.c:116)
>> ==29912==    by 0x4BE9E8: riscv_sifive_u_soc_realize (sifive_u.c:393)
>> ==29912==    by 0x56857D: device_set_realized (qdev.c:834)
>> ==29912==    by 0x756769: property_set_bool (object.c:2074)
>> ==29912==    by 0x7549E5: object_property_set (object.c:1266)
>> ==29912==    by 0x757AAB: object_property_set_qobject (qom-qobject.c:27)
>> ==29912==    by 0x754CCA: object_property_set_bool (object.c:1332)
>> ==29912==    by 0x4BE1F2: riscv_sifive_u_init (sifive_u.c:270)
>> ==29912==    by 0x570FA7: machine_run_board_init (machine.c:1030)
>> ==29912==    by 0x4F46FC: main (vl.c:4479)
>>
>>
>> thanks
>> -- PMM

[Qemu-devel] [PULL] RISC-V Patches for 4.0-rc3, v2

[Palmer Dabbelt]

The following changes since commit 061b51e9195670e9d190cdec46fabcb3c77763fb:

  Update version for v4.0.0-rc2 release (2019-04-02 17:01:20 +0100)

are available in the Git repository at:

  git://github.com/palmer-dabbelt/qemu.git tags/riscv-for-master-4.0-rc3-v2

for you to fetch changes up to 79bcac250f96ba1d4fdecfdc6e3363c9024703a4:

  riscv: plic: Log guest errors (2019-04-04 16:36:21 -0700)

----------------------------------------------------------------
RISC-V Patches for 4.0-rc3, v2

This patch set contains a pair of tightly coupled PLIC bug fixes:

* We were calculating the PLIC addresses incorrectly.
* We were installing the wrong number of PLIC interrupts.

The two bugs togther resulted in a mostly-working system, but they're
impossible to seperate because fixing one bug would result in
significant breakage.  As a result they're in the same patch.

There is also a cleanup to use qemu_log_mask(LOG_GUEST_ERROR,...) for
error reporting.

As far as I know these are the last outstanding RISC-V patches for 4.0.

v2 no longer fails "make check" for me... sorry!

----------------------------------------------------------------
Alistair Francis (2):
      riscv: plic: Fix incorrect irq calculation
      riscv: plic: Log guest errors

 hw/riscv/sifive_plic.c      | 16 +++++++++++-----
 include/hw/riscv/sifive_e.h |  2 +-
 include/hw/riscv/sifive_u.h |  4 ++--
 include/hw/riscv/virt.h     |  2 +-
 4 files changed, 15 insertions(+), 9 deletions(-)

[Qemu-devel] [PULL 1/2] riscv: plic: Fix incorrect irq calculation

[Palmer Dabbelt]

From: Alistair Francis <Alistair.Francis@wdc.com>

This patch fixes four different things, to maintain bisectability they
have been merged into a single patch. The following fixes are below:

sifive_plic: Fix incorrect irq calculation
The irq is incorrectly calculated to be off by one. It has worked in the
past as the priority_base offset has also been set incorrectly. We are
about to fix the priority_base offset so first first the irq
calculation.

sifive_u: Fix PLIC priority base offset and numbering
According to the FU540 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00. The same manual also specifies that the
PLIC only has 53 source priorities. Fix these two incorrect header
files.

We also need to over extend the plic_gpios[] array as the PLIC sources
count from 1 and not 0.

riscv: sifive_e: Fix PLIC priority base offset
According to the FE31 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00.

riscv: virt: Fix PLIC priority base offset
Update the virt offsets based on the newly updated SiFive U and SiFive E
offsets.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
---
 hw/riscv/sifive_plic.c      | 4 ++--
 include/hw/riscv/sifive_e.h | 2 +-
 include/hw/riscv/sifive_u.h | 4 ++--
 include/hw/riscv/virt.h     | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index ac768e6c27f8..0315e035e5fb 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -207,7 +207,7 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: read priority: irq=%d priority=%d\n",
                 irq, plic->source_priority[irq]);
@@ -280,7 +280,7 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         plic->source_priority[irq] = value & 7;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: write priority: irq=%d priority=%d\n",
diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index 7b6d8aed968f..f715f8606fa6 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -70,7 +70,7 @@ enum {
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
 #define SIFIVE_E_PLIC_NUM_SOURCES 127
 #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_E_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_E_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_E_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index be13cc1304cc..892f0eee21bc 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -68,9 +68,9 @@ enum {
 };
 
 #define SIFIVE_U_PLIC_HART_CONFIG "MS"
-#define SIFIVE_U_PLIC_NUM_SOURCES 127
+#define SIFIVE_U_PLIC_NUM_SOURCES 54
 #define SIFIVE_U_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_U_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_U_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_U_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_U_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_U_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index f12deaebd697..568764b57088 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -59,7 +59,7 @@ enum {
 #define VIRT_PLIC_HART_CONFIG "MS"
 #define VIRT_PLIC_NUM_SOURCES 127
 #define VIRT_PLIC_NUM_PRIORITIES 7
-#define VIRT_PLIC_PRIORITY_BASE 0x0
+#define VIRT_PLIC_PRIORITY_BASE 0x04
 #define VIRT_PLIC_PENDING_BASE 0x1000
 #define VIRT_PLIC_ENABLE_BASE 0x2000
 #define VIRT_PLIC_ENABLE_STRIDE 0x80
-- 
2.19.2

[Qemu-devel] [PULL 1/2] riscv: plic: Fix incorrect irq calculation

[Palmer Dabbelt]

From: Alistair Francis <Alistair.Francis@wdc.com>

This patch fixes four different things, to maintain bisectability they
have been merged into a single patch. The following fixes are below:

sifive_plic: Fix incorrect irq calculation
The irq is incorrectly calculated to be off by one. It has worked in the
past as the priority_base offset has also been set incorrectly. We are
about to fix the priority_base offset so first first the irq
calculation.

sifive_u: Fix PLIC priority base offset and numbering
According to the FU540 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00. The same manual also specifies that the
PLIC only has 53 source priorities. Fix these two incorrect header
files.

We also need to over extend the plic_gpios[] array as the PLIC sources
count from 1 and not 0.

riscv: sifive_e: Fix PLIC priority base offset
According to the FE31 manual the PLIC source priority address starts at
an offset of 0x04 and not 0x00.

riscv: virt: Fix PLIC priority base offset
Update the virt offsets based on the newly updated SiFive U and SiFive E
offsets.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
---
 hw/riscv/sifive_plic.c      | 4 ++--
 include/hw/riscv/sifive_e.h | 2 +-
 include/hw/riscv/sifive_u.h | 4 ++--
 include/hw/riscv/virt.h     | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index ac768e6c27f8..0315e035e5fb 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -207,7 +207,7 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: read priority: irq=%d priority=%d\n",
                 irq, plic->source_priority[irq]);
@@ -280,7 +280,7 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
     if (addr >= plic->priority_base && /* 4 bytes per source */
         addr < plic->priority_base + (plic->num_sources << 2))
     {
-        uint32_t irq = (addr - plic->priority_base) >> 2;
+        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
         plic->source_priority[irq] = value & 7;
         if (RISCV_DEBUG_PLIC) {
             qemu_log("plic: write priority: irq=%d priority=%d\n",
diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index 7b6d8aed968f..f715f8606fa6 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -70,7 +70,7 @@ enum {
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
 #define SIFIVE_E_PLIC_NUM_SOURCES 127
 #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_E_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_E_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_E_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index be13cc1304cc..892f0eee21bc 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -68,9 +68,9 @@ enum {
 };
 
 #define SIFIVE_U_PLIC_HART_CONFIG "MS"
-#define SIFIVE_U_PLIC_NUM_SOURCES 127
+#define SIFIVE_U_PLIC_NUM_SOURCES 54
 #define SIFIVE_U_PLIC_NUM_PRIORITIES 7
-#define SIFIVE_U_PLIC_PRIORITY_BASE 0x0
+#define SIFIVE_U_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_U_PLIC_PENDING_BASE 0x1000
 #define SIFIVE_U_PLIC_ENABLE_BASE 0x2000
 #define SIFIVE_U_PLIC_ENABLE_STRIDE 0x80
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index f12deaebd697..568764b57088 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -59,7 +59,7 @@ enum {
 #define VIRT_PLIC_HART_CONFIG "MS"
 #define VIRT_PLIC_NUM_SOURCES 127
 #define VIRT_PLIC_NUM_PRIORITIES 7
-#define VIRT_PLIC_PRIORITY_BASE 0x0
+#define VIRT_PLIC_PRIORITY_BASE 0x04
 #define VIRT_PLIC_PENDING_BASE 0x1000
 #define VIRT_PLIC_ENABLE_BASE 0x2000
 #define VIRT_PLIC_ENABLE_STRIDE 0x80
-- 
2.19.2