summaryrefslogtreecommitdiffstats
path: root/target/ppc/mmu_helper.c
Commit message (Collapse)AuthorAgeFilesLines
* target/ppc: Split out ppc_jumbo_xlateRichard Henderson2021-07-091-83/+96
| | | | | | | | | | Mirror the interface of ppc_radix64_xlate (mostly), putting all of the logic for older mmu translation into a single entry point. For booke, we need to add mmu_idx to the xlate-style interface. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210621125115.67717-8-bruno.larsen@eldorado.org.br> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove PowerPCCPUClass.handle_mmu_faultRichard Henderson2021-07-091-4/+20
| | | | | | | | | | Instead, use a switch on env->mmu_model. This avoids some replicated information in cpu setup. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210621125115.67717-2-bruno.larsen@eldorado.org.br> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: added ifdefs around TCG-only codeBruno Larsen (billionai)2021-06-031-2/+14
| | | | | | | | | | | | | | | | | | | | | excp_helper.c, mmu-hash64.c and mmu_helper.c have some function declarations that are TCG-only, and couldn't be easily moved to a TCG only file, so ifdefs were added around them. We also needed ifdefs around some header files because helper-proto.h includes trace/generated-helpers.h, which is never created when building without TCG, and cpu_ldst.h includes tcg/tcg.h, whose containing folder is not included as a -iquote. As future cleanup, we could change the part of the configuration script to add those. cpu_init.c also had a callback definition that is TCG only and could be removed as part of a future cleanup (all the dump_statistics part is almost never used and will become obsolete as we transition to using decodetree). Signed-off-by: Bruno Larsen (billionai) <bruno.larsen@eldorado.org.br> Message-Id: <20210525115355.8254-3-bruno.larsen@eldorado.org.br> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: fold ppc_store_ptcr into it's only callerBruno Larsen (billionai)2021-06-031-28/+0Star
| | | | | | | | | | ppc_store_ptcr, defined in mmu_helper.c, was only used by helper_store_ptcr, in misc_helper.c. To avoid possible confusion, the function was folded into the helper. Signed-off-by: Bruno Larsen (billionai) <bruno.larsen@eldorado.org.br> Message-Id: <20210526143516.125582-1-bruno.larsen@eldorado.org.br> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument for mmubooke206_get_physical_addressRichard Henderson2021-05-191-2/+2
| | | | | | | | It is no longer used. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-16-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from mmubooke206_check_tlbRichard Henderson2021-05-191-31/+15Star
| | | | | | | | | We can now use MMU_INST_FETCH from access_type for this. Unify the I/D code paths, making use of prot_for_access_type. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-15-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from mmubooke_get_physical_addressRichard Henderson2021-05-191-4/+2Star
| | | | | | | | It is no longer used. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-14-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from mmubooke_check_tlbRichard Henderson2021-05-191-31/+13Star
| | | | | | | | | We can now use MMU_INST_FETCH from access_type for this. Unify the I/D code paths, making use of prot_for_access_type. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-13-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from mmu40x_get_physical_addressRichard Henderson2021-05-191-4/+2Star
| | | | | | | | It is no longer used. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-12-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from get_bat_6xx_tlbRichard Henderson2021-05-191-11/+8Star
| | | | | | | | We can now use MMU_INST_FETCH from access_type for this. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-11-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from ppc6xx_tlb_checkRichard Henderson2021-05-191-6/+4Star
| | | | | | | | We can now use MMU_INST_FETCH from access_type for this. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-10-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from ppc6xx_tlb_pte_checkRichard Henderson2021-05-191-2/+2
| | | | | | | | It is no longer used. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-9-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove type argument from check_protRichard Henderson2021-05-191-27/+6Star
| | | | | | | | | | We can now use MMU_INST_FETCH from access_type for this. Use prot_for_access_type to simplify everything. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-8-richard.henderson@linaro.org> [dwg: Remove a stray trailing whitespace] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Use MMUAccessType in mmu_helper.cRichard Henderson2021-05-191-76/+85
| | | | | | | | | | This replaces 'int rw' with 'MMUAccessType access_type'. Comparisons vs zero become either MMU_DATA_LOAD or MMU_DATA_STORE, since we had previously squashed rw to 0 for code access. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-7-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Rename access_type to type in mmu_helper.cRichard Henderson2021-05-191-32/+32
| | | | | | | | | | The variable that holds ACCESS_INT, ACCESS_FLOAT, etc is variously called 'int type' or 'int access_type' within this file. Standardize on 'int type' throughout. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210518201146.794854-6-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: moved ppc_store_sdr1 to cpu.cBruno Larsen (billionai)2021-05-191-26/+0Star
| | | | | | | | | | | Moved this function that is required in !TCG cases into a common code file Signed-off-by: Bruno Larsen (billionai) <bruno.larsen@eldorado.org.br> Message-Id: <20210512140813.112884-3-bruno.larsen@eldorado.org.br> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [dwg: Fixed compile error with linux-user targets] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Introduce an mmu_is_64bit() helperGreg Kurz2020-12-141-5/+5
| | | | | | | | | Callers don't really need to know how 64-bit MMU model enums are computed. Hide this in a helper. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20201209173536.1437351-3-groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: replaced the TODO with LOG_UNIMP and add break for silence warningsChen Qun2020-12-141-2/+3
| | | | | | | | | | | | | | | | | | | | | | When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning: target/ppc/mmu_helper.c: In function ‘dump_mmu’: target/ppc/mmu_helper.c:1351:12: warning: this statement may fall through [-Wimplicit-fallthrough=] 1351 | if (ppc64_v3_radix(env_archcpu(env))) { | ^ target/ppc/mmu_helper.c:1358:5: note: here 1358 | default: | ^~~~~~~ Use "qemu_log_mask(LOG_UNIMP**)" instead of the TODO comment. And add the break statement to fix it. Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201116024810.2415819-8-kuhn.chenqun@huawei.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* powerpc tcg: Fix Lesser GPL version numberChetan Pant2020-11-151-1/+1
| | | | | | | | | | | | There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201019061126.3102-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* ppc/: fix some comment spelling errorszhaolichang2020-10-271-2/+2
| | | | | | | | | | | | I found that there are many spelling errors in the comments of qemu/target/ppc. I used spellcheck to check the spelling errors and found some errors in the folder. Signed-off-by: zhaolichang <zhaolichang@huawei.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20201009064449.2336-3-zhaolichang@huawei.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target: Remove unnecessary CPU() castPhilippe Mathieu-Daudé2020-05-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CPU() macro is defined as: #define CPU(obj) ((CPUState *)(obj)) which expands to: ((CPUState *)object_dynamic_cast_assert((Object *)(obj), (name), __FILE__, __LINE__, __func__)) This assertion can only fail when @obj points to something other than its stated type, i.e. when we're in undefined behavior country. Remove the unnecessary CPU() casts when we already know the pointer is of CPUState type. Patch created mechanically using spatch with this script: @@ typedef CPUState; CPUState *s; @@ - CPU(s) + s Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-2-f4bug@amsat.org>
* target/ppc: Rewrite a fall through commentPhilippe Mathieu-Daudé2019-08-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: target/ppc/mmu_helper.c: In function ‘dump_mmu’: target/ppc/mmu_helper.c:1349:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 1349 | if (ppc64_v3_radix(env_archcpu(env))) { | ^ target/ppc/mmu_helper.c:1356:5: note: here 1356 | default: | ^~~~~~~ cc1: all warnings being treated as errors Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190719131425.10835-6-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* Include qemu/main-loop.h lessMarkus Armbruster2019-08-161-0/+2
| | | | | | | | | | | | | | | | | | | | In my "build everything" tree, changing qemu/main-loop.h triggers a recompile of some 5600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). It includes block/aio.h, which in turn includes qemu/event_notifier.h, qemu/notify.h, qemu/processor.h, qemu/qsp.h, qemu/queue.h, qemu/thread-posix.h, qemu/thread.h, qemu/timer.h, and a few more. Include qemu/main-loop.h only where it's needed. Touching it now recompiles only some 1700 objects. For block/aio.h and qemu/event_notifier.h, these numbers drop from 5600 to 2800. For the others, they shrink only slightly. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190812052359.30071-21-armbru@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* target/ppc: Use env_cpu, env_archcpuRichard Henderson2019-06-101-68/+47Star
| | | | | | | | | | | Cleanup in the boilerplate that each target must define. Replace ppc_env_get_cpu with env_archcpu. The combination CPU(ppc_env_get_cpu) should have used ENV_GET_CPU to begin; use env_cpu now. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* cpu: Replace ENV_GET_CPU with env_cpuRichard Henderson2019-06-101-1/+1
| | | | | | | | | Now that we have both ArchCPU and CPUArchState, we can define this generically instead of via macro in each target's cpu.h. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Use CPUClass::tlb_fill in cputlb.cRichard Henderson2019-05-101-6/+0Star
| | | | | | | | | | | | We can now use the CPUClass hook instead of a named function. Create a static tlb_fill function to avoid other changes within cputlb.c. This also isolates the asserts within. Remove the named tlb_fill function from all of the targets. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/ppc: Convert to CPUClass::tlb_fillRichard Henderson2019-05-101-9/+13
| | | | | | | Cc: qemu-ppc@nongnu.org Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/ppc: improve performance of large BAT invalidationsArtyom Tarasenko2019-04-261-0/+7
| | | | | | | | | | | | | Performing a complete flush is ~ 100 times faster than flushing 256MiB of 4KiB pages. Set a limit of 1024 pages and perform a complete flush afterwards. This patch significantly speeds up AIX 5.1 and NetBSD-ofppc. Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <1555103178-21894-4-git-send-email-atar4qemu@gmail.com> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Style fixes for mmu_helper.cDavid Gibson2019-04-261-53/+84
| | | | | | Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
* target: Clean up how the dump_mmu() printMarkus Armbruster2019-04-181-37/+33Star
| | | | | | | | | | | | | | | | | | | | | The various dump_mmu() take an fprintf()-like callback and a FILE * to pass to it, and so do their helper functions. Passing around callback and argument is rather tiresome. Most dump_mmu() are called only by the target's hmp_info_tlb(). These all pass monitor_printf() cast to fprintf_function and the current monitor cast to FILE *. SPARC's dump_mmu() gets also called from target/sparc/ldst_helper.c a few times #ifdef DEBUG_MMU. These calls pass fprintf() and stdout. The type-punning is technically undefined behaviour, but works in practice. Clean up: drop the callback, and call qemu_printf() instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190417191805.28198-11-armbru@redhat.com>
* target/ppc/mmu: Use LPCR:HR to chose radix vs. hash translationBenjamin Herrenschmidt2019-02-251-7/+2Star
| | | | | | | | | | Now that LPCR:HR is set properly for SPAPR, use it for deciding the translation type, which also works for bare metal Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190215170029.15641-3-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove some #if 0'ed codeBenjamin Herrenschmidt2019-02-171-12/+0Star
| | | | | | | | | Some debug stuff we don't need to keep there Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190128094625.4428-7-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: add external PID supportRoman Kapl2018-11-081-39/+133
| | | | | | | | | | | | | | | | | | | | | | | External PID is a mechanism present on BookE 2.06 that enables application to store/load data from different address spaces. There are special version of some instructions, which operate on alternate address space, which is specified in the EPLC/EPSC regiser. This implementation uses two additional MMU modes (mmu_idx) to provide the address space for the load and store instructions. The QEMU TLB fill code was modified to recognize these MMU modes and use the values in EPLC/EPSC to find the proper entry in he PPC TLB. These two QEMU TLBs are also flushed on each write to EPLC/EPSC. Following instructions are implemented: dcbfep dcbstep dcbtep dcbtstep dcbzep dcbzlep icbiep lbepx ldepx lfdepx lhepx lwepx stbepx stdepx stfdepx sthepx stwepx. Following vector instructions are not: evlddepx evstddepx lvepx lvepxl stvepx stvepxl. Signed-off-by: Roman Kapl <rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* ppc: Remove deprecated ppcemb targetThomas Huth2018-08-281-3/+3
| | | | | | | | | | | There is no known available OS for ppc around anymore that uses page sizes below 4k, so it does not make much sense that we keep wasting our time on building and testing the ppcemb-softmmu target. It has been deprecated since two releases, and nobody complained, so let's remove this now. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* hw/ppc: Use the IEC binary prefix definitionsPhilippe Mathieu-Daudé2018-07-021-4/+4
| | | | | | | | | | | | | | | It eases code review, unit is explicit. Patch generated using: $ git grep -E '(1024|2048|4096|8192|(<<|>>).?(10|20|30))' hw/ include/hw/ and modified manually. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20180625124238.25339-33-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/ppc: add basic support for PTCR on POWER9Cédric Le Goater2018-05-041-0/+29
| | | | | | | | | | The Partition Table Control Register (PTCR) is a hypervisor privileged SPR. It contains the host real address of the Partition Table and its size. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Get rid of POWERPC_MMU_VER() macrosDavid Gibson2018-04-271-12/+12
| | | | | | | | | | | | | | | These macros were introduced to deal with the fact that the mmu_model field has bit flags mixed in with what's otherwise an enum of various mmu types. We've now eliminated all those flags except for one, and that one - POWERPC_MMU_64 - is already included/compared in the MMU_VER macros. So, we can get rid of those macros and just directly compare mmu_model values in the places it was used. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
* Include qapi/error.h exactly where neededMarkus Armbruster2018-02-091-1/+0Star
| | | | | | | | | | | | | | This cleanup makes the number of objects depending on qapi/error.h drop from 1910 (out of 4743) to 1612 in my "build everything" tree. While there, separate #include from file comment with a blank line, and drop a useless comment on why qemu/osdep.h is included first. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180201111846.21846-5-armbru@redhat.com> [Semantic conflict with commit 34e304e975 resolved, OSX breakage fixed]
* accel/tcg: add size paremeter in tlb_fill()Laurent Vivier2018-01-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The MC68040 MMU provides the size of the access that triggers the page fault. This size is set in the Special Status Word which is written in the stack frame of the access fault exception. So we need the size in m68k_cpu_unassigned_access() and m68k_cpu_handle_mmu_fault(). To be able to do that, this patch modifies the prototype of handle_mmu_fault handler, tlb_fill() and probe_write(). do_unassigned_access() already includes a size parameter. This patch also updates handle_mmu_fault handlers and tlb_fill() of all targets (only parameter, no code change). Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20180118193846.24953-2-laurent@vivier.eu>
* target-ppc: Fix booke206 tlbwe TLB instructionLuc MICHEL2018-01-161-5/+27
| | | | | | | | | When overwritting a valid TLB entry with a new one, the previous page were not flushed in QEMU TLB, leading to incoherent mapping. This commit fixes this. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* booke206: fix tlbnps for fixed size TLBKONRAD Frederic2017-09-081-6/+10
| | | | | | | | | | | Some OS don't populate the TSIZE field when using a fixed size TLB which result in a 1KB TLB. When the TLB is a fixed size TLB the TSIZE field should be ignored. Fix this wrong behavior with MAV 2.0. Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* booke206: fix MAS update on tlb missKONRAD Frederic2017-08-091-1/+1
| | | | | | | | | | | When a tlb instruction miss happen, rw is set to 0 at the bottom of cpu_ppc_handle_mmu_fault which cause the MAS update function to miss the SAS and TS bit in MAS6, MAS1 in booke206_update_mas_tlb_miss. Just calling booke206_update_mas_tlb_miss with rw = 2 solve the issue. Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Add debug function for radix mmu translationSuraj Jitindar Singh2017-07-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | In target/ppc/mmu-hash64.c there already exists the function ppc_hash64_get_phys_page_debug() to get the physical (real) address for a given effective address in hash mode. Implement the function ppc_radix64_get_phys_page_debug() to allow a real address to be obtained for a given effective address in radix mode. This is used when a debugger is attached to qemu. Previously we just had a comment saying this is unimplemented which then fell through to the default case and caused an abort due to unrecognised mmu model as the default had no case for the V3 mmu, which was misleading at best. We reuse ppc_radix64_walk_tree() which is used by the radix fault handler since the process of walking the radix tree is identical. Reported-by: Balbir Singh <bsingharora@gmail.com> Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* spapr: Small cleanup of PPC MMU enumsSam Bobroff2017-03-031-42/+29Star
| | | | | | | | | | | | | | | | | The PPC MMU types are sometimes treated as if they were a bit field and sometime as if they were an enum which causes maintenance problems: flipping bits in the MMU type (which is done on both the 1TB segment and 64K segment bits) currently produces new MMU type values that are not handled in every "switch" on it, sometimes causing an abort(). This patch provides some macros that can be used to filter out the "bit field-like" bits so that the remainder of the value can be switched on, like an enum. This allows removal of all of the "degraded" types from the list and should ease maintenance. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc/POWER9: Add POWER9 mmu fault handlerSuraj Jitindar Singh2017-03-031-0/+15
| | | | | | | | | | | | | | | | | Add a new mmu fault handler for the POWER9 cpu and add it as the handler for the POWER9 cpu definition. This handler checks if the guest is radix or hash based on the value in the partition table entry and calls the correct fault handler accordingly. The hash fault handling code has also been updated to check if the partition is using segment tables. Currently only legacy hash (no segment tables) is supported. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Correct SDR1 maskingDavid Gibson2017-03-011-0/+6
| | | | | | | | | | | | | | | | SDR_64_HTABORG, which indicates the bits of the SDR1 register to use for the base of a 64-bit machine's hashed page table (HPT) isn't correct. It includes the top 46 bits of the register, but in fact the top 4 bits must be zero (according to the ISA v2.07). No actual implementation has supported close to 2^60 bytes of physical address space, so it's kind of irrelevant, but we might as well correct this. In addition, although we checked for bad size values in SDR1, we never reported an error if entirely invalid bits were set there. Add this check to ppc_store_sdr1(). Reported-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Remove the function ppc_hash64_set_sdr1()Suraj Jitindar Singh2017-03-011-6/+5Star
| | | | | | | | | | | | | | The function ppc_hash64_set_sdr1 basically checked the htabsize and set an error if it was too big, otherwise it just stored the value in SPR_SDR1. Given that the only function which calls ppc_hash64_set_sdr1() is ppc_store_sdr1(), why not handle the checking in ppc_store_sdr1() to avoid the extra function call. Note that ppc_store_sdr1() already stores the value in SPR_SDR1 anyway, so we were doing it twice. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> [dwg: Remove unnecessary error temporary] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Manage external HPT via virtual hypervisorDavid Gibson2017-03-011-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The pseries machine type implements the behaviour of a PAPR compliant hypervisor, without actually executing such a hypervisor on the virtual CPU. To do this we need some hooks in the CPU code to make hypervisor facilities get redirected to the machine instead of emulated internally. For hypercalls this is managed through the cpu->vhyp field, which points to a QOM interface with a method implementing the hypercall. For the hashed page table (HPT) - also a hypervisor resource - we use an older hack. CPUPPCState has an 'external_htab' field which when non-NULL indicates that the HPT is stored in qemu memory, rather than within the guest's address space. For consistency - and to make some future extensions easier - this merges the external HPT mechanism into the vhyp mechanism. Methods are added to vhyp for the basic operations the core hash MMU code needs: map_hptes() and unmap_hptes() for reading the HPT, store_hpte() for updating it and hpt_mask() to retrieve its size. To match this, the pseries machine now sets these vhyp fields in its existing vhyp class, rather than reaching into the cpu object to set the external_htab field. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
* target/ppc: Eliminate htab_base and htab_mask variablesDavid Gibson2017-03-011-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | CPUPPCState includes fields htab_base and htab_mask which store the base address (GPA) and size (as a mask) of the guest's hashed page table (HPT). These are set when the SDR1 register is updated. Keeping these in sync with the SDR1 is actually a little bit fiddly, and probably not useful for performance, since keeping them expands the size of CPUPPCState. It also makes some upcoming changes harder to implement. This patch removes these fields, in favour of calculating them directly from the SDR1 contents when necessary. This does make a change to the behaviour of attempting to write a bad value (invalid HPT size) to the SDR1 with an mtspr instruction. Previously, the bad value would be stored in SDR1 and could be retrieved with a later mfspr, but the HPT size as used by the softmmu would be, clamped to the allowed values. Now, writing a bad value is treated as a no-op. An error message is printed in both new and old versions. I'm not sure which behaviour, if either, matches real hardware. I don't think it matters that much, since it's pretty clear that if an OS writes a bad value to SDR1, it's not going to boot. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
* target-ppc: fix Book-E TLB matchingAlex Zuepke2017-02-221-1/+1
| | | | | | | | | | The Book-E TLB matching process should bail out early when a TLB entry matches, but the access permissions are wrong. The CPU will then raise a DSI error instead of a Data TLB error, as described for TLB matching in Freescale and IBM documents. Signed-off-by: Alex Zuepke <azu@sysgo.de> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-02-01 17:50:46 +0100