From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:54509) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RUa9s-0002OR-O9 for qemu-devel@nongnu.org; Sun, 27 Nov 2011 03:32:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RUa9r-0003zS-Ch for qemu-devel@nongnu.org; Sun, 27 Nov 2011 03:32:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:44950) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RUa9r-0003zI-57 for qemu-devel@nongnu.org; Sun, 27 Nov 2011 03:32:19 -0500 Message-ID: <4ED1F58D.1080809@redhat.com> Date: Sun, 27 Nov 2011 10:32:13 +0200 From: Avi Kivity MIME-Version: 1.0 References: <4ECD88EF.2030200@web.de> <4ECFC162.5050408@web.de> In-Reply-To: <4ECFC162.5050408@web.de> Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] Memory read/write issues List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: =?ISO-8859-15?Q?Andreas_F=E4rber?= Cc: qemu-devel Developers , Alexander Graf On 11/25/2011 06:25 PM, Andreas F=E4rber wrote: > Am 24.11.2011 00:59, schrieb Andreas F=E4rber: > > Unlike PowerPC, an architecture that I'm trying to emulate does not > > store branch instructions in the reset vector but a memory address. I= 'm > > therefore trying to read physical address 0x00000 and store its value > > into my env->pc. > >=20 > > I've verified by running with -S that xp /xh 0x00000 shows the expect= ed > > value. > >=20 > > When doing lduw_phys(0x00000) or cpu_read_physical_memory() in the CP= U > > reset function though, I just seem to read from uninitialized memory > > (0xbaba). I've taken care to reorder CPU initialization to after the > > BIOS file is loaded in the machine initialization function. > > Another weird memory issue is that tcg_gen_qemu_st16() succeeds but the > value stored doesn't show up with xp or x on the monitor but 0x0000. > > MOVW 0xf8,#0xfee0 (at 0x02010) is trying to write 0xfee0 to 0xFFFf8. > > Similarly, a subsequent tcg_gen_qemu_ld16u() reads 0x0000 from there. > > TCG snippet: > https://github.com/afaerber/qemu-rl78/commit/d3880bd53a26d224c56d16a6ea= 5950019d411cf0 > > uint8_t sfrp =3D ldub_code(s->pc + 1) & ~0x1; > uint16_t data =3D lduw_code(s->pc + 2); > LOG_DISAS("MOVW 0x%" PRIx8 ",#0x%04" PRIx16 "\n", sfrp, dat= a); > TCGv addr =3D tcg_const_tl(0xFFF00 | sfrp); > TCGv_i32 val =3D tcg_const_i32(data); > tcg_gen_qemu_st16(val, addr, 0); > > /* for testing: */ > tcg_gen_qemu_ld16u(env_sp, addr, 0); > > tcg_temp_free(addr); > tcg_temp_free(val); > > (qemu) info mtree > memory > 00000000-fffffffe (prio 0): system > 00000000-0000ffff (prio 0): rl78g13_pb.code_flash > 000fef00-000ffeff (prio 0): rl78g13_pb.ram > 000ffee0-000ffeff (prio 0): rl78g13_pb.gpr > 000fff00-000fffff (prio 0): rl78g13_pb.sfr > > https://github.com/afaerber/qemu-rl78/blob/d3880bd53a26d224c56d16a6ea59= 50019d411cf0/hw/rl78g13_pb.c#L88 > > memory_region_init_ram(sfr, NULL, "rl78g13_pb.sfr", 256); > memory_region_add_subregion(get_system_memory(), 0xFFF00, sfr); > > Anything obvious that I'm missing? This region is a little special in that it is a subpage RAM region, so it doesn't follow the normal paths where RAM is mapped directly to the guest. Maybe there's some bug in that area. If the target is big endian that could further complicate things. --=20 error compiling committee.c: too many arguments to function