cpu-tests: User mode with UX=1 under a KX=0 kernel (IRIX 6 n32), and loads behind loads

[danifunker]

Two groups of tests that never made it upstream after #109, plus the docs for them. Tests only - no emulator changes.

umode: User mode the way IRIX 6 runs it (new group, 12 tests)

IRIX 6 runs n32 processes with Status.UX = 1 under a 32-bit kernel (KX = 0), so every exception and every ERET switches addressing mode. The rest of the suite runs with KX = SX = UX = 1, and IRIX 5's o32 processes run with all three clear, so nothing covered the switch.

Each test runs a few words at kuseg 0x00400000 in User mode under three Status settings - all64 (KX = SX = UX = 1), irix5 (all clear) and irix6 (UX alone). It records every exception taken: vector, Cause, EPC, BadVAddr, Context, XContext, EntryHi. Covered:

• syscalls as the first and second instruction after ERET (the second is libc's _getuid: li v0,1024; syscall)
• a break, then a syscall right after the handler's ERET
• a software interrupt pending at the ERET
• load and instruction-fetch TLB refills: XTLB vector with UX = 1, the 32-bit one without; fixed up and retried
• KSEG0 and misaligned loads from User mode (AdEL)
• 64-bit operations with UX set

Where it came from. IRIX 6.5's installer died on the sgiindy_MiSTer FPGA core with init died (why = 3, what = 0xb). init's saved frame showed a TLBL at the general exception vector's own address, reported on the syscall in _getuid: the core built the vector address in the kernel's 32-bit mode and fetched it under the process's UX = 1. Before the core's fix, umode/syscall_second reproduced that frame exactly. After it, the core passes all but umode/fetch_miss_entry, on the FPGA and in its simulator, and IRIX 6.2 and 6.5 install.

Also make ONLY=group_umode (any group): builds identity plus one group, for iterating on a slow target such as an HDL simulator.

Loads and stores right behind a load (4 tests)

mem/load_then_load, mem/load_then_load_evict, mem/load_then_store and tlb/load_then_mapped_load: the follow-on to #109's load_then_* tests. A load or store right behind a load, in four cache states, with evictions, an LWL merge, KSEG1 against KSEG0, and TLB walks on either load. mem/load_then_load found the FPGA core releasing a stalled load's execute hold on the completion of the load ahead of it.

Results

IRIS at this branch's base (08be293, default features, interpreter). The control is main's own suite on the same binary, per rules/testing/cpu-tests-known-failure-baseline.md:

	main's suite (246 tests)	this branch (262 tests)	FAIL list
IRIS --cpu r4400	2132 passed / 124 failed	2622 / 124	identical
IRIS --cpu r5000	2119 / 108	2610 / 108	identical

All 16 new tests pass on both. An older IRIS build (2026-08-31) failed some umode refill-vector and KSEG0 checks; current main passes them.

None of the new tests has run on an Indy yet. They are derived from the R4000 manual, and the README's "not yet run on silicon" table and docs/status.md list them.

🤖 Generated with Claude Code