Re: [Qemu-devel] vexpress-a9 aborts when booting decompress code from a modified Linux kernel

[Ilya Lipnitskiy]

On Fri, Oct 16, 2015 at 11:09 AM, Peter Maydell
<address@hidden> wrote:
> You might find it helpful to turn on QEMU's debug logging
> (see the -d and -D options). Chances are that some insn
> in your new code is faulting (probably UNDEFing).
Thanks for the suggestion! Here is what I got:

----------------
IN:
0x60010958:  f57ff04f      dsb    sy
0x6001095c:  f57ff06f      isb    sy
0x60010960:  e1a0f00e      mov    pc, lr

----------------
IN:
0x60010400:  e89d401f      ldm    sp, {r0, r1, r2, r3, r4, lr}
-------------->The end of my custom code
0x60010404:  ee10bf91      mrc    15, 0, fp, cr0, cr1, {4}
0x60010408:  e31b000f      tst    fp, #15    ; 0xf
0x6001040c:  13a0600e      movne    r6, #14    ; 0xe
0x60010410:  1bffffc1      blne    0x6001031c   ----------> (__setup_mmu)

...

----------------
IN:
0x60010414:  e3a00000      mov    r0, #0    ; 0x0
0x60010418:  ee070f9a      mcr    15, 0, r0, cr7, cr10, {4}
0x6001041c:  e31b000f      tst    fp, #15    ; 0xf
0x60010420:  1e080f17      mcrne    15, 0, r0, cr8, cr7, {0}

----------------
IN:
0x60010424:  ee110f10      mrc    15, 0, r0, cr1, cr0, {0}
0x60010428:  e3c00201      bic    r0, r0, #268435456    ; 0x10000000
0x6001042c:  e3800a05      orr    r0, r0, #20480    ; 0x5000
0x60010430:  e380003c      orr    r0, r0, #60    ; 0x3c
0x60010434:  e3c00002      bic    r0, r0, #2    ; 0x2
0x60010438:  e3800501      orr    r0, r0, #4194304    ; 0x400000
0x6001043c:  1e126f50      mrcne    15, 0, r6, cr2, cr0, {2}
0x60010440:  13800001      orrne    r0, r0, #1    ; 0x1
0x60010444:  13e01002      mvnne    r1, #2    ; 0x2
0x60010448:  e3c66102      bic    r6, r6, #-2147483648    ; 0x80000000
0x6001044c:  e3c66003      bic    r6, r6, #3    ; 0x3
0x60010450:  1e023f10      mcrne    15, 0, r3, cr2, cr0, {0}

----------------
IN:
0x60010454:  1e031f10      mcrne    15, 0, r1, cr3, cr0, {0}

----------------
IN:
0x60010458:  1e026f50      mcrne    15, 0, r6, cr2, cr0, {2}

----------------
IN:
0x6001045c:  ee070f95      mcr    15, 0, r0, cr7, cr5, {4}
0x60010460:  ee010f10      mcr    15, 0, r0, cr1, cr0, {0}

Taking exception 3 [Prefetch Abort]
...with IFSR 0x5 IFAR 0x60010464
Taking exception 3 [Prefetch Abort]
...with IFSR 0x5 IFAR 0xc  -----------> Loops forever



Disassembling head.o (Base is 0x600100A0):
...

00000338 <__armv7_mmu_cache_on>:
 338:    e1a0c00e     mov    ip, lr
 33c:    ee100f10     mrc    15, 0, r0, cr0, cr0, {0}
 340:    e59f157c     ldr    r1, [pc, #1404]    ; 8c4 <v7_invalidate_l1+0x64>
 344:    e59f257c     ldr    r2, [pc, #1404]    ; 8c8 <v7_invalidate_l1+0x68>
 348:    e0100002     ands    r0, r0, r2
 34c:    e0300001     eors    r0, r0, r1
 350:    0a000000     beq    358 <v7_invalidate>
 354:    1a000002     bne    364 <l1_self_invalidated>

00000358 <v7_invalidate>:
 358:    e88d401f     stm    sp, {r0, r1, r2, r3, r4, lr}
 35c:    ebfffffe     bl    860 <v7_invalidate_l1>
 360:    e89d401f     ldm    sp, {r0, r1, r2, r3, r4, lr}  ---------->
The end of my custom code

00000364 <l1_self_invalidated>:
 364:    ee10bf91     mrc    15, 0, fp, cr0, cr1, {4}
 368:    e31b000f     tst    fp, #15
 36c:    13a0600e     movne    r6, #14
 370:    1bffffc1     blne    27c <__setup_mmu>
 374:    e3a00000     mov    r0, #0
 378:    ee070f9a     mcr    15, 0, r0, cr7, cr10, {4}
 37c:    e31b000f     tst    fp, #15
 380:    1e080f17     mcrne    15, 0, r0, cr8, cr7, {0}
 384:    ee110f10     mrc    15, 0, r0, cr1, cr0, {0}
 388:    e3c00201     bic    r0, r0, #268435456    ; 0x10000000
 38c:    e3800a05     orr    r0, r0, #20480    ; 0x5000
 390:    e380003c     orr    r0, r0, #60    ; 0x3c
 394:    e3c00002     bic    r0, r0, #2
 398:    e3800501     orr    r0, r0, #4194304    ; 0x400000
 39c:    1e126f50     mrcne    15, 0, r6, cr2, cr0, {2}
 3a0:    13800001     orrne    r0, r0, #1
 3a4:    13e01002     mvnne    r1, #2
 3a8:    e3c66102     bic    r6, r6, #-2147483648    ; 0x80000000
 3ac:    e3c66003     bic    r6, r6, #3
 3b0:    1e023f10     mcrne    15, 0, r3, cr2, cr0, {0}
 3b4:    1e031f10     mcrne    15, 0, r1, cr3, cr0, {0}
 3b8:    1e026f50     mcrne    15, 0, r6, cr2, cr0, {2}
 3bc:    ee070f95     mcr    15, 0, r0, cr7, cr5, {4}
 3c0:    ee010f10     mcr    15, 0, r0, cr1, cr0, {0}   --------->
Prefetch abort (0x60010464)
 3c4:    ee110f10     mrc    15, 0, r0, cr1, cr0, {0}
 3c8:    e3a00000     mov    r0, #0
 3cc:    ee070f95     mcr    15, 0, r0, cr7, cr5, {4}
 3d0:    e1a0f00c     mov    pc, ip