|
This diff has been collapsed as it changes many lines, (681 lines changed)
Show them
Hide them
|
|
|
@@
-0,0
+1,681
|
|
|
|
1
|
#! /usr/bin/tclsh
|
|
|
|
2
|
#
|
|
|
|
3
|
# TCL script to scan disassembled programs against the "LEON3FT Stale Cache
|
|
|
|
4
|
# Entry After Store with Data Tag Parity Error" errata, GRLIB-TN-0009.
|
|
|
|
5
|
#
|
|
|
|
6
|
# The following Cobham components are affected by GRLIB-TN-0009:
|
|
|
|
7
|
# - GR712RC
|
|
|
|
8
|
# - LEON3FT-RTAX (all versions)
|
|
|
|
9
|
# - UT699
|
|
|
|
10
|
# - UT699E
|
|
|
|
11
|
# - UT700
|
|
|
|
12
|
#
|
|
|
|
13
|
# For information on how custom LEON3 systems may be affected, see
|
|
|
|
14
|
# GRLIB-TN-0009.
|
|
|
|
15
|
#
|
|
|
|
16
|
# Copyright (C) 2016, Cobham Gaisler
|
|
|
|
17
|
#
|
|
|
|
18
|
# Usage: sparc-elf-objdump -d program | leon3ft-b2bst-scan.tcl
|
|
|
|
19
|
#
|
|
|
|
20
|
# Command line parameters:
|
|
|
|
21
|
# -nonote: Do not print NOTE messages.
|
|
|
|
22
|
# -noinfo: Do not print INFO messages.
|
|
|
|
23
|
# -silent: Do not print NOTE or INFO messages.
|
|
|
|
24
|
#
|
|
|
|
25
|
# Return values:
|
|
|
|
26
|
# 0: No potential error locations found.
|
|
|
|
27
|
# 1: At least one potential error location found.
|
|
|
|
28
|
#
|
|
|
|
29
|
# Rev. history:
|
|
|
|
30
|
# rev 1, MH, Initial revision, based on ut699scan.tcl. Add scanning for
|
|
|
|
31
|
# store-store errata, reorganize comments
|
|
|
|
32
|
# rev 2, MA, Restruction and clean-up, fixed Sequence B.
|
|
|
|
33
|
# rev 3, MA, Added decoding of casa instruction, exit status and verbosity
|
|
|
|
34
|
# parameters.
|
|
|
|
35
|
# rev 4, MA, Reduced false warnings due to Store into Alternate space
|
|
|
|
36
|
# instructions which can not trig the errata. Script renamed to
|
|
|
|
37
|
# leon3ft-b2bst-scan.tcl.
|
|
|
|
38
|
#
|
|
|
|
39
|
# Note 1: Two modes are available with respect to call/ret (dslot_mode):
|
|
|
|
40
|
# 1) ret, and call are assumed not to have stores in their delay slots.
|
|
|
|
41
|
# The tool will warn if any such operations are found in the delay
|
|
|
|
42
|
# slot of ret,call during the scan
|
|
|
|
43
|
# 0) ret and call may have stores in their delay slots
|
|
|
|
44
|
# The tool will not warn if any such operations are found in the
|
|
|
|
45
|
# delay slot during the scan. Instead it will assume this
|
|
|
|
46
|
# possibility exists when evaluating insns following a function call
|
|
|
|
47
|
#
|
|
|
|
48
|
|
|
|
|
49
|
### CONFIGURATION
|
|
|
|
50
|
set b2bst_seqa_scan 1; # enable/disable scanning for Sequence A
|
|
|
|
51
|
set b2bst_seqb_scan 1; # enable/disable scanning for Sequence B
|
|
|
|
52
|
# set dslot_mode 0; # assume store can be in delay slot of call,jmpl
|
|
|
|
53
|
set dslot_mode 1; # do not allow store in delay slot of call,jmpl
|
|
|
|
54
|
###
|
|
|
|
55
|
|
|
|
|
56
|
# Mask values for types of output messages
|
|
|
|
57
|
set MSG_INFO 1; # Information on things to check manually.
|
|
|
|
58
|
set MSG_NOTE 2; # Notices on branch following
|
|
|
|
59
|
set msglevel [expr {$MSG_INFO | $MSG_NOTE}]
|
|
|
|
60
|
|
|
|
|
61
|
set errata_desc "LEON3FT Stale Cache Entry After Store with Data Tag Parity Error"
|
|
|
|
62
|
set util_rev 4
|
|
|
|
63
|
set util_date "20170215"
|
|
|
|
64
|
|
|
|
|
65
|
set b2bst_seqa_desc "Sequence A"
|
|
|
|
66
|
set b2bst_seqb_desc "Sequence B"
|
|
|
|
67
|
|
|
|
|
68
|
set op_count 0
|
|
|
|
69
|
set lineskip_count 0
|
|
|
|
70
|
set line_count 0
|
|
|
|
71
|
set err_count 0
|
|
|
|
72
|
set fn_count 0
|
|
|
|
73
|
set fninst_count 0
|
|
|
|
74
|
|
|
|
|
75
|
proc puts_info {str} {
|
|
|
|
76
|
global msglevel MSG_INFO
|
|
|
|
77
|
if {$msglevel & $MSG_INFO} { puts "INFO: $str" }
|
|
|
|
78
|
}
|
|
|
|
79
|
|
|
|
|
80
|
proc puts_note {str} {
|
|
|
|
81
|
global msglevel MSG_NOTE
|
|
|
|
82
|
if {$msglevel & $MSG_NOTE} { puts "NOTE: $str" }
|
|
|
|
83
|
}
|
|
|
|
84
|
|
|
|
|
85
|
# ----------------------------------------------------------------------------
|
|
|
|
86
|
# Routine that decodes specified opcode and returns list of
|
|
|
|
87
|
# 0 :optype Class of opcode
|
|
|
|
88
|
# one of call,jmpl,branch,sethi,ld,st,atomic,alu,fpop,save,restore
|
|
|
|
89
|
# 1 :target-reg Register modified by op
|
|
|
|
90
|
# 2 :source-reg1 First source register (rs1)
|
|
|
|
91
|
# 3 :source-reg2 Second source register (rs2)
|
|
|
|
92
|
# 4 :store-reg Source register for store data
|
|
|
|
93
|
# regs are numbered 0-31 integer regs, 32-63 FP regs
|
|
|
|
94
|
# 5 :double-flag
|
|
|
|
95
|
# ORed mask: 8) target-reg is DP, 4) sreg1 is DP, 2) sreg2 is DP, 1) store-reg is DP
|
|
|
|
96
|
# 6 :immed Immediate operand
|
|
|
|
97
|
# 7 :nnpc1 Next instructions nPC if branch not taken (normal case), normally nPC+4
|
|
|
|
98
|
# 8 :nnpc2 Next instruction's nPC if branch is taken, if not branch then nnpc2=nnpc1
|
|
|
|
99
|
# 9 :annul
|
|
|
|
100
|
# ORed mask: next inst annulled if 2) branch not taken 1) branch taken
|
|
|
|
101
|
# 10:bubbles Number of extra cycles spent in decode stage (bubbles inserted)
|
|
|
|
102
|
proc decode_inst { opcode {pc "0x00000000"} {npc "0x00000004"}} {
|
|
|
|
103
|
# Some "sta" instructions do not trig the errata. The related ASI:s are
|
|
|
|
104
|
# defined here.
|
|
|
|
105
|
set safeasi [list 0x02 0x03 0x04 0x0c 0x0d 0x0e 0x0f 0x10 0x11 0x13 0x14 0x15 0x18 0x19 0x1c 0x1d 0x1e]
|
|
|
|
106
|
#Default values if no cond matches
|
|
|
|
107
|
set opname "unknown"
|
|
|
|
108
|
set destreg 0
|
|
|
|
109
|
set sreg1 0
|
|
|
|
110
|
set sreg2 0
|
|
|
|
111
|
set streg 0
|
|
|
|
112
|
set dblflag 0
|
|
|
|
113
|
set immed 0
|
|
|
|
114
|
|
|
|
|
115
|
if { [string is integer $npc] } {
|
|
|
|
116
|
set nnpc1 [format "0x%08x" [ expr {$npc+4} ] ]
|
|
|
|
117
|
} else {
|
|
|
|
118
|
set nnpc1 "$npc+4"
|
|
|
|
119
|
}
|
|
|
|
120
|
set nnpc2 $nnpc1
|
|
|
|
121
|
set annul 0
|
|
|
|
122
|
set bubbles 0
|
|
|
|
123
|
#Decode
|
|
|
|
124
|
set op1 [ expr {$opcode >> 30} ]
|
|
|
|
125
|
if { $op1 == 1 } {
|
|
|
|
126
|
set opname "call"
|
|
|
|
127
|
set disp [ expr { ($opcode & 0x3fffffff)<<2 } ]
|
|
|
|
128
|
set nnpc1 [ format "0x%08x" [ expr { $pc + $disp } ] ]
|
|
|
|
129
|
set nnpc2 $nnpc1
|
|
|
|
130
|
} elseif { $op1 == 0 } {
|
|
|
|
131
|
set op2 [ expr {($opcode >> 22) & 7} ]
|
|
|
|
132
|
# NOTE: 2=Bicc, 6=FBcc, 7=CBcc
|
|
|
|
133
|
if { $op2 == 2 || $op2 == 6 } {
|
|
|
|
134
|
set opname "branch"
|
|
|
|
135
|
set disp [expr { ($opcode & 0x3fffff) << 2 } ]
|
|
|
|
136
|
if { $disp > 0x800000 } { set disp [expr {$disp - 0x1000000}] }
|
|
|
|
137
|
# Todo check cond,annul, handle always or never
|
|
|
|
138
|
set nnpc2 [ format "0x%08x" [ expr { $pc + $disp } ] ]
|
|
|
|
139
|
set cond [ expr { ($opcode >> 25) & 15 } ]
|
|
|
|
140
|
set annulbit [ expr { $opcode & 0x20000000 } ]
|
|
|
|
141
|
if { $cond == 0 } { # Branch never
|
|
|
|
142
|
set nnpc2 $nnpc1
|
|
|
|
143
|
if { $annulbit } { set annul 3 }
|
|
|
|
144
|
} elseif { $cond == 8 } { # Branch always
|
|
|
|
145
|
set nnpc1 $nnpc2
|
|
|
|
146
|
if { $annulbit } { set annul 3 }
|
|
|
|
147
|
} else { # True cond branch
|
|
|
|
148
|
if { $annulbit } { set annul 2 }
|
|
|
|
149
|
}
|
|
|
|
150
|
} elseif { $op2 == 4 } {
|
|
|
|
151
|
set opname "sethi"
|
|
|
|
152
|
set destreg [ expr { ($opcode >> 25) & 31 } ]
|
|
|
|
153
|
set immed [ expr { ($opcode & 0x3fffff) << 10 } ]
|
|
|
|
154
|
}
|
|
|
|
155
|
} elseif { $op1 == 3 } {
|
|
|
|
156
|
# SPARC V8 Table F-4
|
|
|
|
157
|
# set opname "mem" - changed to use ld/st/atomic instead
|
|
|
|
158
|
set op3 [ expr { ($opcode >> 19) & 63 } ]
|
|
|
|
159
|
set rs1 [ expr { (($opcode >> 14) & 31) } ]
|
|
|
|
160
|
set rs2 [ expr { (($opcode ) & 31) } ]
|
|
|
|
161
|
set rd [ expr { (($opcode >> 25) & 31) } ]
|
|
|
|
162
|
set sreg1 $rs1
|
|
|
|
163
|
if { $opcode & 0x2000 } {
|
|
|
|
164
|
set immed [ expr { $opcode & 0x1fff } ]
|
|
|
|
165
|
if { $immed > 0xfff } { set immed [ expr { $immed-(0x2000) } ] }
|
|
|
|
166
|
} else {
|
|
|
|
167
|
set sreg2 $rs2
|
|
|
|
168
|
}
|
|
|
|
169
|
if { (($op3 & 13) == 13) || ($op3 == 0x3c) } {
|
|
|
|
170
|
# Atomic ldst/swap/casa
|
|
|
|
171
|
set opname "atomic"
|
|
|
|
172
|
set destreg $rd
|
|
|
|
173
|
set streg $rd
|
|
|
|
174
|
} else {
|
|
|
|
175
|
# Adjust reg no if FP ld/st (op3[5]=1)
|
|
|
|
176
|
if { ($op3 & 0x20) != 0 } { set rd [expr {32 + $rd} ] }
|
|
|
|
177
|
# Check if read or write op3[2]
|
|
|
|
178
|
if { ($op3 & 4) != 0 } {
|
|
|
|
179
|
set opname "st"
|
|
|
|
180
|
set streg $rd
|
|
|
|
181
|
set allow_safe_sta true
|
|
|
|
182
|
if { $allow_safe_sta && (($op3 & 0x3c) == 0x14) } {
|
|
|
|
183
|
# op3 is 0x14, 0x15, 0x16 or 0x17 (sta, stba, stha or stda)
|
|
|
|
184
|
# (if i = 0)
|
|
|
|
185
|
set asi [expr { (($opcode >> 5) & 0xff) }]
|
|
|
|
186
|
set safematch [lsearch -exact -integer $safeasi $asi]
|
|
|
|
187
|
if {0 <= $safematch} {
|
|
|
|
188
|
set opname "sta_safe"
|
|
|
|
189
|
}
|
|
|
|
190
|
}
|
|
|
|
191
|
} else {
|
|
|
|
192
|
set opname "ld"
|
|
|
|
193
|
set destreg $rd
|
|
|
|
194
|
}
|
|
|
|
195
|
# Check size op3[1:0]
|
|
|
|
196
|
if { ($op3 & 3) == 3 } {
|
|
|
|
197
|
if { $opname eq "st" } { set dblflag 1 } else { set dblflag 8 }
|
|
|
|
198
|
}
|
|
|
|
199
|
}
|
|
|
|
200
|
} else {
|
|
|
|
201
|
set op3 [ expr { ($opcode >> 19) & 63 } ]
|
|
|
|
202
|
if { $op3 == 0x34 || $op3 == 0x35 } {
|
|
|
|
203
|
set opname "fpop"
|
|
|
|
204
|
set opf [ expr { ($opcode >> 5) & 0x1ff } ]
|
|
|
|
205
|
set rs1 [ expr { 32 + (($opcode >> 14) & 31) } ]
|
|
|
|
206
|
set rs2 [ expr { 32 + (($opcode ) & 31) } ]
|
|
|
|
207
|
set rd [ expr { 32 + (($opcode >> 25) & 31) } ]
|
|
|
|
208
|
# opf[1:0] corresponds to operand size of rs2
|
|
|
|
209
|
# opf[7:6]=11 is conv op, opf[3:2] gives opsize of rd, rs1 unused
|
|
|
|
210
|
# opf[7:6]=00 is single-operand op, rd same size as rs2, rs1 unused
|
|
|
|
211
|
# opf[7:4]=0100 regular op, rs1,rd same size as rs2
|
|
|
|
212
|
# opf[7:4]=0101 comp op, rd unused, rs1 same size as rs2
|
|
|
|
213
|
# opf[7:4]=0110 conv+mul, opf[3:2] gives opsize of rd, rs1 same size as rs2
|
|
|
|
214
|
set sreg2 $rs2
|
|
|
|
215
|
if { ($opf & 3) > 1 } { set dblflag 2 }
|
|
|
|
216
|
if { ($opf & 0xc0) == 0x40 } {
|
|
|
|
217
|
set sreg1 $rs1
|
|
|
|
218
|
if { $dblflag & 2 } { set dblflag [ expr { $dblflag | 4 } ] }
|
|
|
|
219
|
}
|
|
|
|
220
|
if { ($opf & 0xc0) == 0xc0 || ($opf & 0xf0) == 0x60 } {
|
|
|
|
221
|
set destreg $rd
|
|
|
|
222
|
if { ($opf & 0xc) > 4 } { set dblflag [ expr { $dblflag | 8 } ] }
|
|
|
|
223
|
} elseif { ($opf & 0xf0) != 0x50 } {
|
|
|
|
224
|
set destreg $rd
|
|
|
|
225
|
if { $dblflag & 2 } { set dblflag [ expr { $dblflag | 8 } ] }
|
|
|
|
226
|
}
|
|
|
|
227
|
} else {
|
|
|
|
228
|
set opname "alu"
|
|
|
|
229
|
set destreg [ expr { (($opcode >> 25) & 31) } ]
|
|
|
|
230
|
set sreg1 [ expr { (($opcode >> 14) & 31) } ]
|
|
|
|
231
|
if { $opcode & 0x2000 } {
|
|
|
|
232
|
set immed [ expr { $opcode & 0x1fff } ]
|
|
|
|
233
|
if { $immed > 0xfff } { set immed [ expr { $immed-(0x2000) } ] }
|
|
|
|
234
|
} else {
|
|
|
|
235
|
set sreg2 [ expr { (($opcode ) & 31) } ]
|
|
|
|
236
|
}
|
|
|
|
237
|
if { $op3 == 0x38 } {
|
|
|
|
238
|
set opname "jmpl"
|
|
|
|
239
|
set nnpc1 "jmpaddr"
|
|
|
|
240
|
set nnpc2 "jmpaddr"
|
|
|
|
241
|
set bubbles 2
|
|
|
|
242
|
} elseif { $op3 == 0x3c } {
|
|
|
|
243
|
set opname "save"
|
|
|
|
244
|
} elseif { $op3 == 0x3d } {
|
|
|
|
245
|
set opname "restore"
|
|
|
|
246
|
}
|
|
|
|
247
|
}
|
|
|
|
248
|
}
|
|
|
|
249
|
#Return values
|
|
|
|
250
|
return [list $opname $destreg $sreg1 $sreg2 $streg $dblflag $immed $nnpc1 $nnpc2 $annul $bubbles]
|
|
|
|
251
|
}
|
|
|
|
252
|
|
|
|
|
253
|
proc is_store { opcode } {
|
|
|
|
254
|
set op1 [ expr { ($opcode >> 30) } ]
|
|
|
|
255
|
set op3 [ expr { ($opcode >> 19) & 63 } ]
|
|
|
|
256
|
return [expr {($op1 == 3) && (($op3 & 0xc) == 0x4)}]
|
|
|
|
257
|
}
|
|
|
|
258
|
|
|
|
|
259
|
# -------------------------------------------------------------------------------------
|
|
|
|
260
|
|
|
|
|
261
|
proc unpack { l args } {
|
|
|
|
262
|
for { set i 0 } { $i < [llength $args] } { incr i } {
|
|
|
|
263
|
uplevel 1 "set [lindex $args $i] [lindex $l $i]"
|
|
|
|
264
|
}
|
|
|
|
265
|
}
|
|
|
|
266
|
|
|
|
|
267
|
# --------- Postprocessing on whole function
|
|
|
|
268
|
|
|
|
|
269
|
# Number of instructions printed is starti + 2
|
|
|
|
270
|
proc print_trace { fnpc state fnarr seqstart {starti 4}} {
|
|
|
|
271
|
upvar $fnarr fnops
|
|
|
|
272
|
|
|
|
|
273
|
puts " # PC Opcode"
|
|
|
|
274
|
set cnt [expr {$seqstart-$starti}]
|
|
|
|
275
|
for { set x $starti } { $x > -2 } { set x [expr {$x-1}] } {
|
|
|
|
276
|
incr cnt
|
|
|
|
277
|
if { $cnt > 0 } { set cntv $cnt } else { set cntv " " }
|
|
|
|
278
|
if { $x >= 0 } { set pc [lindex $state $x] } else { set pc $fnpc }
|
|
|
|
279
|
if { $pc eq "?" || $pc eq "call" || $pc eq "ret" || $pc eq "dslot" } {
|
|
|
|
280
|
puts " $cntv (other fn) $pc"
|
|
|
|
281
|
} else {
|
|
|
|
282
|
if { [string index $pc 0] eq "A" } {
|
|
|
|
283
|
set pc [string range $pc 1 end]
|
|
|
|
284
|
set annul " (annulled)"
|
|
|
|
285
|
} else {
|
|
|
|
286
|
set annul ""
|
|
|
|
287
|
}
|
|
|
|
288
|
if { [info exists fnops($pc)] } {
|
|
|
|
289
|
set op $fnops($pc)
|
|
|
|
290
|
} else {
|
|
|
|
291
|
set op [list "0x???????? (outside func)"]
|
|
|
|
292
|
}
|
|
|
|
293
|
puts " $cntv $pc [join $op] $annul"
|
|
|
|
294
|
}
|
|
|
|
295
|
}
|
|
|
|
296
|
puts ""
|
|
|
|
297
|
}
|
|
|
|
298
|
|
|
|
|
299
|
# Routine called by scan_wholefunc_main to check
|
|
|
|
300
|
# instruction sequences described in GRLIB-TN-009, Issue 1.0
|
|
|
|
301
|
#
|
|
|
|
302
|
# "Sequence A"
|
|
|
|
303
|
# 1. store of word size or less (st / stb / sth / stf)
|
|
|
|
304
|
# 2. any single instruction that is not a load or store
|
|
|
|
305
|
# 3. any store instruction (st / stb / sth / stf / std / stdf)
|
|
|
|
306
|
#
|
|
|
|
307
|
# "Sequence B"
|
|
|
|
308
|
# 1. store of double word size (std / stdf)
|
|
|
|
309
|
# 2. any store instruction (st / stb / sth / stf / std / stdf)
|
|
|
|
310
|
proc scan_b2bst { fnname fnpc fnop opdec fnarr state } {
|
|
|
|
311
|
global b2bst_seqa_scan
|
|
|
|
312
|
global b2bst_seqb_scan
|
|
|
|
313
|
upvar $fnarr fnops
|
|
|
|
314
|
global dslot_mode
|
|
|
|
315
|
|
|
|
|
316
|
# Check latest 3 insn if they can be st/std/regular
|
|
|
|
317
|
set pca [list $fnpc [lindex $state 0] [lindex $state 1]]
|
|
|
|
318
|
set can_be_arr [list]
|
|
|
|
319
|
for { set i 0 } { $i < 3 } { incr i } {
|
|
|
|
320
|
set can_be [list 0 0 0] ; # st std regular
|
|
|
|
321
|
set pcv [lindex $pca $i]
|
|
|
|
322
|
if { $pcv eq "?" } {
|
|
|
|
323
|
set can_be [list 1 1 1]
|
|
|
|
324
|
} elseif { $pcv eq "dslot" } {
|
|
|
|
325
|
set can_be [list [expr {1-$dslot_mode}] [expr {1-$dslot_mode}] 1]
|
|
|
|
326
|
} elseif { [string index $pcv 0] eq "A" || $pcv eq "call" || $pcv eq "ret" } {
|
|
|
|
327
|
set can_be [list 0 0 1]
|
|
|
|
328
|
} else {
|
|
|
|
329
|
set op $fnops($pcv)
|
|
|
|
330
|
set ophex [lindex $op 0]
|
|
|
|
331
|
set opdec [decode_inst $ophex]
|
|
|
|
332
|
set optype [lindex $opdec 0]
|
|
|
|
333
|
set opstorereg [lindex $opdec 4]
|
|
|
|
334
|
set opdblflag [lindex $opdec 5]
|
|
|
|
335
|
if { $optype eq "st" && ($opdblflag & 1) } {
|
|
|
|
336
|
set can_be [list 0 1 0]
|
|
|
|
337
|
} elseif { $optype eq "st" } {
|
|
|
|
338
|
set can_be [list 1 0 0]
|
|
|
|
339
|
} elseif { $optype ne "ld" && $optype ne "atomic" } {
|
|
|
|
340
|
# Any single instruction that is not a load or store
|
|
|
|
341
|
set can_be [list 0 0 1]
|
|
|
|
342
|
}
|
|
|
|
343
|
}
|
|
|
|
344
|
lappend can_be_arr $can_be
|
|
|
|
345
|
}
|
|
|
|
346
|
# can_be_arr has at index
|
|
|
|
347
|
# - at index 2: previous previous instruction
|
|
|
|
348
|
# - at index 1: previous instruction
|
|
|
|
349
|
# - at index 0: current instruction
|
|
|
|
350
|
set pp_insn [lindex $can_be_arr 2]
|
|
|
|
351
|
set p_insn [lindex $can_be_arr 1]
|
|
|
|
352
|
set c_insn [lindex $can_be_arr 0]
|
|
|
|
353
|
# Sequence A
|
|
|
|
354
|
# 1. store of word size or less
|
|
|
|
355
|
# 2. any single instruction that is not a load or store
|
|
|
|
356
|
# 3. any store instruction
|
|
|
|
357
|
if {
|
|
|
|
358
|
(
|
|
|
|
359
|
$b2bst_seqa_scan &&
|
|
|
|
360
|
[lindex $pp_insn 0] &&
|
|
|
|
361
|
[lindex $p_insn 2] &&
|
|
|
|
362
|
([lindex $c_insn 0] || [lindex $c_insn 1])
|
|
|
|
363
|
) } {
|
|
|
|
364
|
puts "WARNING: Possible sequence matching LEON3FT b2bst errata (sequence A) in function $fnname"
|
|
|
|
365
|
print_trace $fnpc $state fnops 1
|
|
|
|
366
|
puts ""
|
|
|
|
367
|
return 1
|
|
|
|
368
|
}
|
|
|
|
369
|
|
|
|
|
370
|
# Sequence B
|
|
|
|
371
|
# 1. any store instruction
|
|
|
|
372
|
# 2. store of double word size
|
|
|
|
373
|
if {
|
|
|
|
374
|
(
|
|
|
|
375
|
$b2bst_seqb_scan &&
|
|
|
|
376
|
[lindex $p_insn 1] &&
|
|
|
|
377
|
([lindex $c_insn 0] || [lindex $c_insn 1])
|
|
|
|
378
|
) } {
|
|
|
|
379
|
puts "WARNING: Possible sequence matching LEON3FT b2bst errata (sequence B) in function $fnname"
|
|
|
|
380
|
print_trace $fnpc $state fnops 0
|
|
|
|
381
|
puts ""
|
|
|
|
382
|
return 1
|
|
|
|
383
|
}
|
|
|
|
384
|
return 0
|
|
|
|
385
|
}
|
|
|
|
386
|
|
|
|
|
387
|
|
|
|
|
388
|
# Main recursive function doing scan
|
|
|
|
389
|
# fnname - funcion name
|
|
|
|
390
|
# fnpc, fnnpc, PC/nPC of current insn (8-digit hex, 0x prefix) prefix also with A if annulled,
|
|
|
|
391
|
# fnarr - array/hash-table, see descr for scan_wholefunc
|
|
|
|
392
|
# dpdist - number of SP FPOPs done minimum since last DP FPOP
|
|
|
|
393
|
# state - List of 5 last instruction addresses (hex w 0x prefix), special values "?"=unknown "call"=call from calling proc
|
|
|
|
394
|
# smap - Hash table used to track where we have been already
|
|
|
|
395
|
proc scan_wholefunc_main { fnname fnpc fnnpc fnarr savelevel dpdist state smap lastoptype } {
|
|
|
|
396
|
global dslot_mode
|
|
|
|
397
|
upvar $fnarr fnops
|
|
|
|
398
|
upvar $smap statemap
|
|
|
|
399
|
|
|
|
|
400
|
set r 0
|
|
|
|
401
|
|
|
|
|
402
|
# puts "entering scan_wholefunc_main: PC:$fnpc nPC:$fnnpc dpdist:$dpdist savelevel:$savelevel state:$state"
|
|
|
|
403
|
# puts "fnops exists [info exists fnops] [array exists fnops] [array names fnops]"
|
|
|
|
404
|
while {1} {
|
|
|
|
405
|
# puts "scan_wholefunc_main: PC:$fnpc nPC:$fnnpc dpdist:$dpdist savelevel:$savelevel state:$state"
|
|
|
|
406
|
set statedesc [list $fnpc $fnnpc $savelevel $dpdist $state]
|
|
|
|
407
|
if { [info exists statemap($statedesc)] } {
|
|
|
|
408
|
# Already been here
|
|
|
|
409
|
return $r
|
|
|
|
410
|
}
|
|
|
|
411
|
set statemap($statedesc) 1
|
|
|
|
412
|
|
|
|
|
413
|
set fnpca $fnpc
|
|
|
|
414
|
set pcannul 0
|
|
|
|
415
|
if { [string index $fnpc 0] eq "A" } {
|
|
|
|
416
|
set pcannul 1
|
|
|
|
417
|
set fnpc [string range $fnpc 1 end]
|
|
|
|
418
|
set ophex "0x01000000"
|
|
|
|
419
|
} else {
|
|
|
|
420
|
if {![info exists fnops($fnpc)]} {
|
|
|
|
421
|
puts_note "$fnname: Execution leaves function without return";
|
|
|
|
422
|
return $r
|
|
|
|
423
|
}
|
|
|
|
424
|
|
|
|
|
425
|
set op $fnops($fnpc)
|
|
|
|
426
|
set ophex [lindex $op 0]
|
|
|
|
427
|
set opname [lindex $op 1]
|
|
|
|
428
|
}
|
|
|
|
429
|
|
|
|
|
430
|
set opdec [ decode_inst $ophex $fnpc $fnnpc ]
|
|
|
|
431
|
unpack $opdec optype treg sreg1 sreg2 streg dblflag immed nnpc1 nnpc2 annul bubbles
|
|
|
|
432
|
|
|
|
|
433
|
set prev_savelevel $savelevel
|
|
|
|
434
|
if { $optype eq "fpop" } {
|
|
|
|
435
|
# update dpdist
|
|
|
|
436
|
if { ($dblflag & 6) == 0 } {
|
|
|
|
437
|
if { $dpdist < 2 } { incr dpdist }
|
|
|
|
438
|
} else {
|
|
|
|
439
|
set dpdist 0
|
|
|
|
440
|
}
|
|
|
|
441
|
} elseif { $optype eq "save" } {
|
|
|
|
442
|
if { $savelevel > 9 } {
|
|
|
|
443
|
puts_note "$fnname: More than 10 deep saves (possibly regfile clear loop)"
|
|
|
|
444
|
} else {
|
|
|
|
445
|
incr savelevel
|
|
|
|
446
|
}
|
|
|
|
447
|
# puts "save at $fnpc, new savelevel: $savelevel"
|
|
|
|
448
|
} elseif { $optype eq "restore" } {
|
|
|
|
449
|
if { $savelevel < -9 } {
|
|
|
|
450
|
puts_note "$fnname: More than 10 deep restores (possibly regfile clear loop)"
|
|
|
|
451
|
} else {
|
|
|
|
452
|
if { $savelevel == 0 } {
|
|
|
|
453
|
puts_note "$fnname: More restore than save instructions"
|
|
|
|
454
|
}
|
|
|
|
455
|
set savelevel [ expr { $savelevel-1} ]
|
|
|
|
456
|
}
|
|
|
|
457
|
# puts "restore at $fnpc, new savelevel: $savelevel"
|
|
|
|
458
|
}
|
|
|
|
459
|
if { true && ($optype eq "st") } {
|
|
|
|
460
|
if { [scan_b2bst $fnname $fnpc $op $opdec fnops $state] } { incr r }
|
|
|
|
461
|
}
|
|
|
|
462
|
|
|
|
|
463
|
# Handle jmpl and call
|
|
|
|
464
|
# If in delay slot of jmpl:
|
|
|
|
465
|
# If ret or retl, stop recursing further
|
|
|
|
466
|
# If other jmpl, check savelevel if it will return or not
|
|
|
|
467
|
# If in delay slot of call, set dpdist to 0 (called proc may have done DP operation)
|
|
|
|
468
|
set is_call 0
|
|
|
|
469
|
if {
|
|
|
|
470
|
(
|
|
|
|
471
|
$dslot_mode != 0 &&
|
|
|
|
472
|
($lastoptype eq "branch" || $lastoptype eq "jmpl" || $lastoptype eq "call")
|
|
|
|
473
|
) } {
|
|
|
|
474
|
if { $optype eq "st" } {
|
|
|
|
475
|
puts "WARNING: $fnname: $opname in delay slot of branch/call/ret at $fnpc may cause errata"
|
|
|
|
476
|
print_trace $fnpc $state fnops -1 1
|
|
|
|
477
|
puts ""
|
|
|
|
478
|
incr r
|
|
|
|
479
|
}
|
|
|
|
480
|
}
|
|
|
|
481
|
if { $lastoptype eq "jmpl" } {
|
|
|
|
482
|
set linst [lindex $state 0]
|
|
|
|
483
|
set q $fnops($linst)
|
|
|
|
484
|
set qh [lindex $q 0]
|
|
|
|
485
|
set qdec [ decode_inst $qh $linst $fnpc ]
|
|
|
|
486
|
unpack $qdec qdtype qdtreg qdsreg1 qdsreg2 qdstreg qddblflag qdimmed qdnnpc1 qdnnpc2 qdannul
|
|
|
|
487
|
if { $qdtreg==15 && $prev_savelevel==1 && $savelevel==1 } {
|
|
|
|
488
|
# Function call via pointer
|
|
|
|
489
|
incr is_call
|
|
|
|
490
|
} elseif { $qdtreg==0 && $savelevel==0 } {
|
|
|
|
491
|
# Return or tail recursion
|
|
|
|
492
|
return $r
|
|
|
|
493
|
} else {
|
|
|
|
494
|
# Computed goto or some other non-standard construct
|
|
|
|
495
|
puts_info "$fnname: Unable to trace jmpl at $linst - check manually"
|
|
|
|
496
|
return $r
|
|
|
|
497
|
}
|
|
|
|
498
|
} elseif { $lastoptype eq "call" } {
|
|
|
|
499
|
if { $savelevel==0 && $prev_savelevel==1 } {
|
|
|
|
500
|
# call,restore tail recursion into other fn
|
|
|
|
501
|
return $r
|
|
|
|
502
|
} elseif { $savelevel==0 && $prev_savelevel==0 && $treg == 15 } {
|
|
|
|
503
|
puts_note "$fnname: Leaf tail recursion construct at $fnpc"
|
|
|
|
504
|
return $r
|
|
|
|
505
|
} else {
|
|
|
|
506
|
incr is_call
|
|
|
|
507
|
}
|
|
|
|
508
|
}
|
|
|
|
509
|
# Update history
|
|
|
|
510
|
for { set z 0 } { $z <= $bubbles } { incr z } {
|
|
|
|
511
|
set state [concat $fnpca [lrange $state 0 4] ]
|
|
|
|
512
|
}
|
|
|
|
513
|
if { $is_call } {
|
|
|
|
514
|
if { $optype eq "branch" || $optype eq "call" || $optype eq "jmpl" } {
|
|
|
|
515
|
puts_info "$fnname: jump in delay slot of call - check manually"
|
|
|
|
516
|
}
|
|
|
|
517
|
# Setup state after call has returned
|
|
|
|
518
|
set dpdist 0
|
|
|
|
519
|
set state [list "dslot" "ret" "ret" "ret" "?" ]
|
|
|
|
520
|
set optype "?"; # for lastoptype
|
|
|
|
521
|
set fnnpc [ format "0x%08x" [expr {$fnpc+4}]]
|
|
|
|
522
|
set nnpc1 [ format "0x%08x" [expr {$fnpc+8}]]
|
|
|
|
523
|
set nnpc2 $nnpc1
|
|
|
|
524
|
set annul 0
|
|
|
|
525
|
}
|
|
|
|
526
|
# Handle annullment
|
|
|
|
527
|
if { ($annul & 2) != 0 } { set npc1 "A$fnnpc" } else { set npc1 $fnnpc }
|
|
|
|
528
|
if { ($annul & 1) != 0 } { set npc2 "A$fnnpc" } else { set npc2 $fnnpc }
|
|
|
|
529
|
# Recurse if multiple nPC:s, tail recurse for last element
|
|
|
|
530
|
if { $nnpc1 != $nnpc2 || $npc1 != $npc2 } {
|
|
|
|
531
|
# puts "Recursion nnpc:$nnpc2!"
|
|
|
|
532
|
set q [scan_wholefunc_main $fnname $npc1 $nnpc2 fnops $savelevel $dpdist $state statemap $optype]
|
|
|
|
533
|
set r [expr {$r+$q}]
|
|
|
|
534
|
}
|
|
|
|
535
|
set fnpc $npc1
|
|
|
|
536
|
set fnnpc $nnpc1
|
|
|
|
537
|
set lastoptype $optype
|
|
|
|
538
|
}
|
|
|
|
539
|
}
|
|
|
|
540
|
|
|
|
|
541
|
# Whole function scan for "LEON3FT Stale Cache After Store with Data Tag Parity Error" errata
|
|
|
|
542
|
# fnname - function name, fnaddr - function addres
|
|
|
|
543
|
# fnarr - name of array/hash-table containing operations
|
|
|
|
544
|
# key to the array is the address as 8-digit hex number prefixed with 0x
|
|
|
|
545
|
# value is a list containing 0:opcode, 1:mnemonic, 2:args
|
|
|
|
546
|
proc scan_wholefunc { fnname fnaddr fnarr } {
|
|
|
|
547
|
global fn_count fninst_count;
|
|
|
|
548
|
upvar $fnarr fnops
|
|
|
|
549
|
|
|
|
|
550
|
if { $fnname eq ".text" } {
|
|
|
|
551
|
puts "WARNING: The disassembled binary appears to be stripped, the script can not scan stripped binaries"
|
|
|
|
552
|
}
|
|
|
|
553
|
|
|
|
|
554
|
# Does the fn not contain any store at all, then we can skip it
|
|
|
|
555
|
set sid [array startsearch fnops]
|
|
|
|
556
|
set found_st 0
|
|
|
|
557
|
while { !$found_st } {
|
|
|
|
558
|
set op [array nextelement fnops $sid]
|
|
|
|
559
|
if { $op eq "" } { array donesearch fnops $sid; break }
|
|
|
|
560
|
set ophex [lindex $fnops($op) 0]
|
|
|
|
561
|
# puts "$ophex"
|
|
|
|
562
|
if { [is_store $ophex] } { incr found_st }
|
|
|
|
563
|
}
|
|
|
|
564
|
if { !$found_st } {
|
|
|
|
565
|
# puts "No store in $fnname!"
|
|
|
|
566
|
return 0
|
|
|
|
567
|
}
|
|
|
|
568
|
|
|
|
|
569
|
# -- Function contains store, proceed with scanning
|
|
|
|
570
|
# puts "Checking $fnname"
|
|
|
|
571
|
set pc "0x$fnaddr"
|
|
|
|
572
|
# puts "pc: $pc"
|
|
|
|
573
|
set npc [format "0x%08x" [expr {$pc+4}]]
|
|
|
|
574
|
array unset statemap
|
|
|
|
575
|
array set statemap ""
|
|
|
|
576
|
set ec [scan_wholefunc_main $fnname $pc $npc fnops 0 0 [list "dslot" "call" "?" "?" "?" "?"] statemap "?"]
|
|
|
|
577
|
# Update fn_count/fninst_count
|
|
|
|
578
|
incr fn_count
|
|
|
|
579
|
array unset itagchk
|
|
|
|
580
|
array set itagchk ""
|
|
|
|
581
|
set sid [array startsearch statemap]
|
|
|
|
582
|
while { [array anymore statemap $sid] } {
|
|
|
|
583
|
set x [array nextelement statemap $sid]
|
|
|
|
584
|
set iaddr [lindex $x 0]
|
|
|
|
585
|
# puts "iaddr: $iaddr"
|
|
|
|
586
|
if { [info exists fnops($iaddr)] && ![info exists itagchk($iaddr)]} {
|
|
|
|
587
|
incr fninst_count
|
|
|
|
588
|
set itagchk($iaddr) 1
|
|
|
|
589
|
}
|
|
|
|
590
|
}
|
|
|
|
591
|
array donesearch statemap $sid
|
|
|
|
592
|
return $ec
|
|
|
|
593
|
}
|
|
|
|
594
|
|
|
|
|
595
|
|
|
|
|
596
|
# --------- Main routine
|
|
|
|
597
|
|
|
|
|
598
|
if { ! [info exists sourcing] } {
|
|
|
|
599
|
|
|
|
|
600
|
# Parse command line
|
|
|
|
601
|
for {set i 0} {$i < $argc} {incr i} {
|
|
|
|
602
|
set arg [lindex $argv $i]
|
|
|
|
603
|
puts "arg=$arg"
|
|
|
|
604
|
if {"-noinfo" eq $arg} {
|
|
|
|
605
|
set msglevel [expr {$msglevel & ~($MSG_INFO)}]
|
|
|
|
606
|
}
|
|
|
|
607
|
if {"-nonote" eq $arg} {
|
|
|
|
608
|
set msglevel [expr {$msglevel & ~($MSG_NOTE)}]
|
|
|
|
609
|
}
|
|
|
|
610
|
if {"-silent" eq $arg} {
|
|
|
|
611
|
set msglevel 0
|
|
|
|
612
|
}
|
|
|
|
613
|
}
|
|
|
|
614
|
|
|
|
|
615
|
puts "\n$errata_desc errata scanning utility, rev $util_rev ($util_date)"
|
|
|
|
616
|
|
|
|
|
617
|
puts "Searching objdump -d output on standard input for:"
|
|
|
|
618
|
if {$b2bst_seqa_scan} {
|
|
|
|
619
|
puts " - $b2bst_seqa_desc"
|
|
|
|
620
|
}
|
|
|
|
621
|
if {$b2bst_seqb_scan} {
|
|
|
|
622
|
puts " - $b2bst_seqb_desc"
|
|
|
|
623
|
}
|
|
|
|
624
|
puts ""
|
|
|
|
625
|
|
|
|
|
626
|
set fn_valid 0
|
|
|
|
627
|
while {! [eof stdin]} {
|
|
|
|
628
|
set l [gets stdin]
|
|
|
|
629
|
incr line_count
|
|
|
|
630
|
# puts "line $l"
|
|
|
|
631
|
# Remove comment after '!'
|
|
|
|
632
|
set x [string first "!" "$l"]
|
|
|
|
633
|
if { $x >= 0 } then { set l [string range "$l" 0 $x] }
|
|
|
|
634
|
# check if entry point / function start
|
|
|
|
635
|
set m [regexp {^ *([0-9A-Fa-f]+) <([^ ]+)>:} "$l" t1 addr symname]
|
|
|
|
636
|
if { $m > 0 } then {
|
|
|
|
637
|
# puts "Function name=$symname addr=$addr"
|
|
|
|
638
|
if { $fn_valid } {
|
|
|
|
639
|
# puts $curfn_ops(0x40000000)
|
|
|
|
640
|
set q [scan_wholefunc $curfn $curfn_addr curfn_ops]
|
|
|
|
641
|
# puts "q=$q err_count=$err_count"
|
|
|
|
642
|
set err_count [ expr { $err_count + $q } ]
|
|
|
|
643
|
}
|
|
|
|
644
|
set curfn "$symname"
|
|
|
|
645
|
set curfn_addr "$addr"
|
|
|
|
646
|
array unset curfn_ops
|
|
|
|
647
|
array set curfn_ops ""
|
|
|
|
648
|
set fn_valid 0
|
|
|
|
649
|
} else {
|
|
|
|
650
|
# Check if opcode
|
|
|
|
651
|
set m [regexp {^ *([0-9A-Fa-f]+): *\t(.. .. .. ..) *\t([^ ]+)(.*)$} "$l" t1 addr hexcode opname opargs]
|
|
|
|
652
|
if { $m > 0 } then {
|
|
|
|
653
|
# puts "Opcode name=$opname args=$opargs addr=$addr"
|
|
|
|
654
|
incr op_count
|
|
|
|
655
|
set addr [format "%08x" 0x$addr]
|
|
|
|
656
|
set hexcode [string map {" " ""} $hexcode]
|
|
|
|
657
|
# puts "setting curfn_ops 0x$addr"
|
|
|
|
658
|
set curfn_ops(0x$addr) [list "0x$hexcode" $opname $opargs "" ""]
|
|
|
|
659
|
incr fn_valid
|
|
|
|
660
|
} else {
|
|
|
|
661
|
incr lineskip_count
|
|
|
|
662
|
}
|
|
|
|
663
|
}
|
|
|
|
664
|
}
|
|
|
|
665
|
if { $fn_valid } {
|
|
|
|
666
|
set q [scan_wholefunc $curfn $curfn_addr curfn_ops]
|
|
|
|
667
|
set err_count [ expr { $err_count + $q } ]
|
|
|
|
668
|
}
|
|
|
|
669
|
|
|
|
|
670
|
puts "\nObjdump lines processed: $line_count, lines skipped: $lineskip_count"
|
|
|
|
671
|
puts "Functions scanned: ${fn_count}, reachable instruction count: ${fninst_count}"
|
|
|
|
672
|
puts "Potential error locations found: $err_count\n"
|
|
|
|
673
|
|
|
|
|
674
|
if {$err_count == 0} {
|
|
|
|
675
|
exit 0
|
|
|
|
676
|
} else {
|
|
|
|
677
|
exit 1
|
|
|
|
678
|
}
|
|
|
|
679
|
|
|
|
|
680
|
}
|
|
|
|
681
|
|
