Comments (5)
Hi @Ye-Jinhong, can you elaborate the issue more? (i.e., what was the unexpected output for c.jal/c.jalr?)
from gem5.
Hi @hnpl , it is specified that jalr
should set the bit 0 to zero in RISC-V unpriviledge isa spec.
The indirect jump instruction JALR (jump and link register) uses the I-type encoding. The target address is obtained by adding the sign-extended 12-bit I-immediate to the register rs1, then setting the least-significant bit of the result to zero.
And in "C" extension, c.jr/c.jalr
expands to jalr x0/x1 0(rs1)
C.JR (jump register) performs an unconditional control transfer to the address in register rs1. C.JR expands to jalr x0, 0(rs1).
C.JALR (jump and link register) performs the same operation as C.JR, but additionally writes the address of the instruction following the jump (pc+2) to the link register, x1. C.JALR expands to jalr x1, 0(rs1).
So the result of c.jr/c.jalr rs1
which is the next fetch PC should equals to 0 + rs1 of jalr
, setting the bit 0 to zero. This means the result is the value (rs1 + 0) & ~0x1
.
In decoder.isa, line 450 to 456
0x0: Jump::c_jr({{
if (RC1 == 0) {
return std::make_shared<IllegalInstFault>(
"source reg x0", machInst);
}
NPC = rvZext(Rc1);
}}, IsIndirectControl, IsUncondControl);
and line 468 to 471
default: Jump::c_jalr({{
ra = rvSext(NPC);
NPC = rvZext(Rc1);
}}, IsIndirectControl, IsUncondControl, IsCall);
The NPC is not correct due to not masking the bit 0 like NPC = rvZext(Rc1) & ~0x1
.
I came across this when I build my own o3 cpu model, when the rs1 is not even in wrong path, fetch unit will fetch from the unaligned Addr. Although this will not cause error as a squash following, but it is a sematic wrong against RISC-V unpriviledge spec.
Affects version
All version.
Expected behavior
The next PC should always be even no matter it is on right instruction path or not.
from gem5.
I see. If I'm not mistaken, that's a bug.
Interestingly, gem5 O3CPU does jump to the correct location due to branch prediction mechanism [1]. This is because c_jr's and c_jalr's branchTarget() function do generate the correct address, and if Rc1 is not 2-byte aligned, it is a branch misprediction (and if the branch predictor learned this, there'll be no misprediction later on).
I'm not sure about the c_jr and c_jalr in other gem5 cpu types given that they call the instructions's execute() function directly to get the new PC.
std::unique_ptr<PCStateBase>
C_jr::branchTarget(ThreadContext *tc) const
{
PCStateBase *pc_ptr = tc->pcState().clone();
pc_ptr->as<PCState>().set((tc->getReg(srcRegIdx(0)) + imm) & ~0x1);
return std::unique_ptr<PCStateBase>{pc_ptr};
}
std::unique_ptr<PCStateBase>
C_jalr::branchTarget(ThreadContext *tc) const
{
PCStateBase *pc_ptr = tc->pcState().clone();
pc_ptr->as<PCState>().set((tc->getReg(srcRegIdx(0)) + imm) & ~0x1);
return std::unique_ptr<PCStateBase>{pc_ptr};
}
[1]
Lines 717 to 723 in ffd0680
@powerjg, @aarmejach: please correct if I'm wrong, my memory is rather vague on O3CPU branch prediction.
from gem5.
@Ye-Jinhong can you make a PR that fixes this?
from gem5.
I am closing this issue because PR #1163 has been merged. Please feel free to reopen it if I am mistaken and the issue is not resolved. Thanks.
from gem5.
Related Issues (20)
- mouse.cc throws panic: Resetting mouse wrap mode unimplemented.
- Failed to connect GDB for RISC-V CPU
- Disk images updates for v24.0
- Using Ruby-CHI as a soft NoC for cosimulation with Xiangshan tile HOT 1
- arch-x86: logical instructions execute in-order due to flags input dependency on Zaps CCReg
- arch-x86: register moves erroneously depend on prior value in destination register
- broken docker pull ghcr.io/gem5ubuntu-20.04_all-dependencies:v23-0 HOT 1
- tests,arch-riscv: adding rvv intrinsic test suite
- gem5 gcn3 vega run database HOT 9
- X86 kvm sometimes fail with timer error
- RISCV SE mode: pthread_create() leads to a problem with clone3() HOT 3
- x86MinorCPU doesn't work HOT 2
- arch-riscv: remove default `vlen=256` parameters
- java jdk 11 Out of Memory Error HOT 2
- Failure to bringup 2+ KVM CPUs on X86 HOT 8
- Ruby Protocol: unhandled event type in MI_example-dir.sm HOT 5
- Qemu@SSH Connection failed while buliding diskImage using Packer for full system simu. HOT 3
- About CHI config.py HOT 1
- square can not run under the gpufs HOT 9
- Should this read LDADDALB?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gem5.