arc: Allow IO on AUX reg handling (fixes icount on ARC)

[abrodkin]

AUX registers are used in ARC processors to deal with settings or internal states of different internals like built-in timers, interrupt controller(s), caches etc.

Though for us here interrupts and timers are of the main interest as those are very good examples of IO operations and we do need explicitly allow it to make icount subsystem happy, as otherwise on the first attempt to set ARC built-in timer LIMIT register we see icount_get_raw_locked() barking: qemu-system-arc: Bad icount read, and that's because:

gdb --args ./build/qemu-system-arc ... -icount auto

...

(gdb) b icount.c:116
Breakpoint 1 at 0x54178a: file ../softmmu/icount.c, line 116.

(gdb) r

...

Thread 3 "qemu-system-arc" hit Breakpoint 1, icount_get_raw_locked () at ../softmmu/icount.c:116
116                 error_report("Bad icount read");
(gdb) bt
#0  icount_get_raw_locked () at ../softmmu/icount.c:116
#1  0x0000555555a957d5 in icount_get_locked () at ../softmmu/icount.c:128
#2  0x0000555555a9586d in icount_get () at ../softmmu/icount.c:154
#3  0x0000555555a901fd in tcg_get_virtual_clock () at ../accel/tcg/tcg-cpus.c:524
#4  0x0000555555a0fe05 in cpus_get_virtual_clock () at ../softmmu/cpus.c:211
#5  0x0000555555c88fd4 in qemu_clock_get_ns (type=QEMU_CLOCK_VIRTUAL) at ../util/qemu-timer.c:638
#6  0x00005555559aa8eb in cpu_arc_timer_update (env=0x5555565280a0, timer=0) at ../target/arc/timer.c:42
#7  0x00005555559ab272 in cpu_arc_store_limit (env=0x5555565280a0, timer=0, value=500000) at ../target/arc/timer.c:246
 #8  0x00005555559aba04 in aux_timer_set (aux_reg_detail=0x5555562eedb0 <arc_aux_regs_detail+2352>, val=500000, data=0x5555565280a0) at ../target/arc/timer.c:436
#9  0x00005555559a4cb2 in helper_sr (env=0x5555565280a0, val=500000, aux=35) at ../target/arc/op_helper.c:209
#10 0x00007fffb041dc6a in code_gen_buffer ()
#11 0x0000555555a2f6c8 in cpu_tb_exec (cpu=0x55555651f960, itb=0x7fffb041db00 <code_gen_buffer+4315859>) at ./accel/tcg/cpu-exec.c:178
#12 0x0000555555a304ae in cpu_loop_exec_tb (cpu=0x55555651f960, tb=0x7fffb041db00 <code_gen_buffer+4315859>, ast_tb=0x7ffff6013928, tb_exit=0x7ffff6013920)
     at ../accel/tcg/cpu-exec.c:658
#13 0x0000555555a307a6 in cpu_exec (cpu=0x55555651f960) at ../accel/tcg/cpu-exec.c:771
#14 0x0000555555a8f911 in tcg_cpu_exec (cpu=0x55555651f960) at ../accel/tcg/tcg-cpus.c:243
#15 0x0000555555a8fc12 in tcg_rr_cpu_thread_fn (arg=0x55555651f960) at ../accel/tcg/tcg-cpus.c:346
#16 0x0000555555c9562e in qemu_thread_start (args=0x5555565339e0) at ../util/qemu-thread-posix.c:521
#17 0x00007ffff7899609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x00007ffff77c0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Fix that, hinting QEMU about possible IO on access of AUX regs, which are only possible via LR & SR instructions.

[abrodkin]

FWIW here's a nice high-level explanation of icount implementation in QEMU: https://qemu.readthedocs.io/en/latest/devel/tcg-icount.html

[claziss]

Based on the link which you shared, your patch is not OK.

[claziss]

Accordingly to ur link:

[abrodkin]

@claziss well, the first question is how that action of "ending of the TB" should be done?
Also if I look at how others use that gen_io_start() (https://elixir.bootlin.com/qemu/latest/A/ident/gen_io_start), I cannot figure-out how it differs from what I implemented here - we just process a very specific instruction. Moreover given we do exist from the target code executing LR/SR handlers I'd assume TB ends there anyway. So what's wrong there then?

[abrodkin]

@claziss what about existing usage of that same gen_io_start() in https://github.com/foss-for-synopsys-dwc-arc-processors/qemu/blob/master/target/arc/translate.c#L320?

static void arc_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
{
    DisasContext *dc = container_of(dcbase, DisasContext, base);


    tcg_gen_insn_start(dc->base.pc_next);
    dc->cpc = dc->base.pc_next;

    if (dc->base.num_insns == dc->base.max_insns &&
        (dc->base.tb->cflags & CF_LAST_IO)) {
        gen_io_start();
    }
}

Does TB immediately ends there?

[abrodkin]

@evgeniy-paltsev that's my dirty hack to enable icount on today's merged https://github.com/foss-for-synopsys-dwc-arc-processors/qemu/tree/arc64 tree.

Note it should be usable for both ARCv2 & ARCv3 64-bit QEMU binaries.

diff --git a/target/arc/semfunc-v3.c b/target/arc/semfunc-v3.c
index 20f7d76955..5755f90456 100644
--- a/target/arc/semfunc-v3.c
+++ b/target/arc/semfunc-v3.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "translate.h"
 #include "semfunc-v3.h"
+#include "exec/gen-icount.h"



@@ -4229,6 +4230,8 @@ int
 arc_gen_LR (DisasCtxt *ctx, TCGv dest, TCGv src)
 {
   int ret = DISAS_NEXT;
+  if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT)
+      gen_io_start();
   TCGv temp_1 = tcg_temp_local_new();
   readAuxReg(temp_1, src);
   tcg_gen_andi_tl(temp_1, temp_1, 0xffffffff);
@@ -12016,6 +12019,8 @@ int
 arc_gen_LRL (DisasCtxt *ctx, TCGv dest, TCGv src)
 {
   int ret = DISAS_NEXT;
+  if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT)
+      gen_io_start();
   TCGv temp_1 = tcg_temp_local_new();
   readAuxReg(temp_1, src);
   tcg_gen_mov_tl(dest, temp_1);
diff --git a/target/arc/semfunc.c b/target/arc/semfunc.c
index 2ee63398c4..755a90967d 100644
--- a/target/arc/semfunc.c
+++ b/target/arc/semfunc.c
@@ -22,6 +22,7 @@
 #include "qemu/osdep.h"
 #include "translate.h"
 #include "target/arc/semfunc.h"
+#include "exec/gen-icount.h"

 /*
  * FLAG
@@ -3830,6 +3831,10 @@ int
 arc_gen_LR(DisasCtxt *ctx, TCGv dest, TCGv src)
 {
     int ret = DISAS_NEXT;
+
+    if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT)
+        gen_io_start();
+
     TCGv temp_1 = tcg_temp_local_new();
     readAuxReg(temp_1, src);
     tcg_gen_mov_tl(dest, temp_1);
diff --git a/target/arc/translate.c b/target/arc/translate.c
index 7c2e45dede..301b446ad4 100644
--- a/target/arc/translate.c
+++ b/target/arc/translate.c
@@ -24,6 +24,7 @@
 #include "tcg/tcg-op-gvec.h"
 #include "target/arc/semfunc.h"
 #include "target/arc/arc-common.h"
+#include "exec/gen-icount.h"

 /* Globals */
 TCGv    cpu_S1f;
@@ -745,6 +746,8 @@ arc_gen_SR(DisasCtxt *ctx, TCGv src2, TCGv src1)
 {
     int ret = DISAS_NEXT;

+    if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT)
+        gen_io_start();
 #if defined(TARGET_ARCV2)
     writeAuxReg(src2, src1);
 #elif defined(TARGET_ARCV3)
@@ -760,6 +763,8 @@ arc_gen_SRL(DisasCtxt *ctx, TCGv src2, TCGv src1)
 {
     int ret = DISAS_NEXT;

+    if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT)
+        gen_io_start();
     writeAuxReg(src2, src1);
     return ret;
 }

[cupertinomiranda]

QEMU support for icount has been done. This pull request is outdated based on current state.