summaryrefslogtreecommitdiffstats
path: root/target/ppc/translate.c
Commit message (Collapse)AuthorAgeFilesLines
* target/ppc: Introduce an mmu_is_64bit() helperGreg Kurz2020-12-141-1/+1
| | | | | | | | | Callers don't really need to know how 64-bit MMU model enums are computed. Hide this in a helper. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20201209173536.1437351-3-groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* ppc/translate: Use POWERPC_MMU_64 to detect 64-bit MMU modelsStephane Duverger2020-12-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | The ppc_tr_init_disas_context() function currently checks whether the MMU is 64-bit by ANDing its model type with POWERPC_MMU_64B. This is wrong : POWERPC_MMU_64B isn't a mask, it is the generic MMU model for pre-PowerISA-2.03 64-bit CPUs (ie. PowerPC 970 in QEMU). Use POWERPC_MMU_64 instead of POWERPC_MMU_64B. This should fix a potential bug with some 32-bit CPUs for which 'need_access_type' was mis-computed because (POWERPC_MMU_32B & POWERPC_MMU_64B) happens to be equal to 1. The end result being a crash in ppc_hash32_direct_store() because the access type isn't set: cpu_abort(cs, "ERROR: instruction should not need " "address translation\n"); This doesn't change anything for 'lazy_tlb_flush' since POWERPC_MMU_32B is checked first. Fixes: 5f2a6254522b ("ppc: Don't set access_type on all load/stores on hash64") Signed-off-by: Stephane Duverger <stephane.duverger@free.fr> [groug: - extended patch to address another misuse of POWERPC_MMU_64B - updated title and changelog accordingly] Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20201209173536.1437351-2-groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* powerpc tcg: Fix Lesser GPL version numberChetan Pant2020-11-151-1/+1
| | | | | | | | | | | | There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201019061126.3102-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.2-20200818' ↵Peter Maydell2020-08-241-0/+40
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queue 2020-08-18 Here's my first pull request for qemu-5.2, which has quite a few accumulated things. Highlights are: * Preliminary support for POWER10 (Power ISA 3.1) instruction emulation * Add documentation on the (very confusing) pseries NUMA configuration * Fix some bugs handling edge cases with XICS, XIVE and kernel_irqchip * Fix icount for a number of POWER registers * Many cleanups to error handling in XIVE code * Validate size of -prom-env data # gpg: Signature made Tue 18 Aug 2020 05:18:36 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-5.2-20200818: (40 commits) spapr/xive: Use xive_source_esb_len() nvram: Exit QEMU if NVRAM cannot contain all -prom-env data spapr/xive: Simplify error handling of kvmppc_xive_cpu_synchronize_state() ppc/xive: Simplify error handling in xive_tctx_realize() spapr/xive: Simplify error handling in kvmppc_xive_connect() ppc/xive: Fix error handling in vmstate_xive_tctx_*() callbacks spapr/xive: Fix error handling in kvmppc_xive_post_load() spapr/kvm: Fix error handling in kvmppc_xive_pre_save() spapr/xive: Rework error handling of kvmppc_xive_set_source_config() spapr/xive: Rework error handling in kvmppc_xive_get_queues() spapr/xive: Rework error handling of kvmppc_xive_[gs]et_queue_config() spapr/xive: Rework error handling of kvmppc_xive_cpu_[gs]et_state() spapr/xive: Rework error handling of kvmppc_xive_mmap() spapr/xive: Rework error handling of kvmppc_xive_source_reset() spapr/xive: Rework error handling of kvmppc_xive_cpu_connect() spapr: Simplify error handling in spapr_phb_realize() spapr/xive: Convert KVM device fd checks to assert() ppc/xive: Introduce dedicated kvm_irqchip_in_kernel() wrappers ppc/xive: Rework setup of XiveSource::esb_mmio target/ppc: Integrate icount to purr, vtb, and tbu40 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/ppc: add byte-reverse br[dwh] instructionsLijun Pan2020-08-121-0/+40
| | | | | | | | | | | | | | | | | | | | | | POWER ISA 3.1 introduces following byte-reverse instructions: brd: Byte-Reverse Doubleword X-form brw: Byte-Reverse Word X-form brh: Byte-Reverse Halfword X-form Signed-off-by: Lijun Pan <ljp@linux.ibm.com> Message-Id: <20200701234344.91843-4-ljp@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | meson: rename included C source files to .c.incPaolo Bonzini2020-08-211-11/+11
|/ | | | | | | | | | | | | | | | | | | | | | | | | | With Makefiles that have automatically generated dependencies, you generated includes are set as dependencies of the Makefile, so that they are built before everything else and they are available when first building the .c files. Alternatively you can use a fine-grained dependency, e.g. target/arm/translate.o: target/arm/decode-neon-shared.inc.c With Meson you have only one choice and it is a third option, namely "build at the beginning of the corresponding target"; the way you express it is to list the includes in the sources of that target. The problem is that Meson decides if something is a source vs. a generated include by looking at the extension: '.c', '.cc', '.m', '.C' are sources, while everything else is considered an include---including '.inc.c'. Use '.c.inc' to avoid this, as it is consistent with our other convention of using '.rst.inc' for included reStructuredText files. The editorconfig file is adjusted. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/ppc: Add support for scv and rfscv instructionsNicholas Piggin2020-05-271-1/+52
| | | | | | | | | | | POWER9 adds scv and rfscv instructions and the system call vectored interrupt. Linux does not support this instruction yet but it has been tested with a modified kernel that runs on real hardware. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200507115328.789175-1-npiggin@gmail.com> [dwg: Corrected an overlong line] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target-ppc: fix rlwimi, rlwinm, rlwnm for Clang-9Daniele Buono2020-05-071-3/+21
| | | | | | | | | | | | | | | | | Starting with Clang v9, -Wtype-limits is implemented and triggers a few "result of comparison is always true" errors when compiling PPC32 targets. The comparisons seem to be necessary only on PPC64, since the else branch in PPC32 only has a "g_assert_not_reached();" in all cases. This patch restructures the code so that the actual if/else is done on a local flag variable, that is set accordingly for PPC64, and always true for PPC32. Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com> Message-Id: <20200505183818.32688-2-dbuono@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix TCG temporary leaks in gen_slbia()Philippe Mathieu-Daudé2020-04-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | This fixes: $ qemu-system-ppc64 \ -machine pseries-4.1 -cpu power9 \ -smp 4 -m 12G -accel tcg ... ... Quiescing Open Firmware ... Booting Linux via __start() @ 0x0000000002000000 ... Opcode 1f 12 0f 00 (7ce003e4) leaked temporaries Opcode 1f 12 0f 00 (7ce003e4) leaked temporaries Opcode 1f 12 0f 00 (7ce003e4) leaked temporaries [*] https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05400.html Fixes: 0418bf78fe8 ("Fix ISA v3.0 (POWER9) slbia implementation") Reported-by: Dennis Clarke <dclarke@blastwave.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 20200417090749.14310-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/ppc: Fix mtmsr(d) L=1 variant that loses interruptsNicholas Piggin2020-04-171-19/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If mtmsr L=1 sets MSR[EE] while there is a maskable exception pending, it does not cause an interrupt. This causes the test case to hang: https://lists.gnu.org/archive/html/qemu-ppc/2019-10/msg00826.html More recently, Linux reduced the occurance of operations (e.g., rfi) which stop translation and allow pending interrupts to be processed. This started causing hangs in Linux boot in long-running kernel tests, running with '-d int' shows the decrementer stops firing despite DEC wrapping and MSR[EE]=1. https://lists.ozlabs.org/pipermail/linuxppc-dev/2020-April/208301.html The cause is the broken mtmsr L=1 behaviour, which is contrary to the architecture. From Power ISA v3.0B, p.977, Move To Machine State Register, Programming Note states: If MSR[EE]=0 and an External, Decrementer, or Performance Monitor exception is pending, executing an mtmsrd instruction that sets MSR[EE] to 1 will cause the interrupt to occur before the next instruction is executed, if no higher priority exception exists Fix this by handling L=1 exactly the same way as L=0, modulo the MSR bits altered. The confusion arises from L=0 being "context synchronizing" whereas L=1 is "execution synchronizing", which is a weaker semantic. However this is not a relaxation of the requirement that these exceptions cause interrupts when MSR[EE]=1 (e.g., when mtmsr executes to completion as TCG is doing here), rather it specifies how a pipelined processor can have multiple instructions in flight where one may influence how another behaves. Cc: qemu-stable@nongnu.org Reported-by: Anton Blanchard <anton@ozlabs.org> Reported-by: Nathan Chancellor <natechancellor@gmail.com> Tested-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200414111131.465560-1-npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix ISA v3.0 (POWER9) slbia implementationNicholas Piggin2020-03-241-1/+4
| | | | | | | | | | | | | | The new ISA v3.0 slbia variants have not been implemented for TCG, which can lead to crashing when a POWER9 machine boots Linux using the hash MMU, for example ("disable_radix" kernel command line). Add them. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200319064439.1020571-1-npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [dwg: Fixed compile error for USER_ONLY builds] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix rlwinm on ppc64Vitaly Chikunov2020-03-171-9/+11
| | | | | | | | | | | | | | | | | | | | rlwinm cannot just AND with Mask if shift value is zero on ppc64 when Mask Begin is greater than Mask End and high bits are set to 1. Note that PowerISA 3.0B says that for `rlwinm' ROTL32 is used, and ROTL32 is defined (in 3.3.14) so that rotated value should have two copies of lower word of the source value. This seems to be another incarnation of the fix from 820724d170 ("target-ppc: Fix rlwimi, rlwinm, rlwnm again"), except I leave optimization when Mask value is less than 32 bits. Fixes: 7b4d326f47 ("target-ppc: Use the new deposit and extract ops") Cc: qemu-stable@nongnu.org Signed-off-by: Vitaly Chikunov <vt@altlinux.org> Message-Id: <20200309204557.14836-1-vt@altlinux.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Add privileged message send facilitiesCédric Le Goater2020-02-021-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Processor Control facility for POWER8 processors and later provides a mechanism for the hypervisor to send messages to other threads in the system (msgsnd instruction) and cause hypervisor-level exceptions. Privileged non-hypervisor programs can also send messages (msgsndp instruction) but are restricted to the threads of the same subprocessor and cause privileged-level exceptions. The Directed Privileged Doorbell Exception State (DPDES) register reflects the state of pending privileged doorbell exceptions and can be used to modify that state. The register can be used to read and modify the state of privileged doorbell exceptions for all threads of a subprocessor and thus is a shared facility for that subprocessor. The register can be read/written by the hypervisor and read by the supervisor if enabled in the HFSCR, otherwise a hypervisor facility unavailable exception is generated. The privileged message send and clear instructions (msgsndp & msgclrp) are used to generate and clear the presence of a directed privileged doorbell exception, respectively. The msgsndp instruction can be used to target any thread of the current subprocessor, msgclrp acts on the thread issuing the instruction. These instructions are privileged, but will generate a hypervisor facility unavailable exception if not enabled in the HFSCR and executed in privileged non-hypervisor state. The HV facility unavailable exception will be addressed in other patch. Add and implement this register and instructions by reading or modifying the pending interrupt state of the cpu. Note that TCG only supports one thread per core and so we only need to worry about the cpu making the access. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200120104935.24449-2-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* tcg: Search includes from the project root source directoryPhilippe Mathieu-Daudé2020-01-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently search both the root and the tcg/ directories for tcg files: $ git grep '#include "tcg/' | wc -l 28 $ git grep '#include "tcg[^/]' | wc -l 94 To simplify the preprocessor search path, unify by expliciting the tcg/ directory. Patch created mechanically by running: $ for x in \ tcg.h tcg-mo.h tcg-op.h tcg-opc.h \ tcg-op-gvec.h tcg-gvec-desc.h; do \ sed -i "s,#include \"$x\",#include \"tcg/$x\"," \ $(git grep -l "#include \"$x\""); \ done Acked-by: David Gibson <david@gibson.dropbear.id.au> (ppc parts) Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200101112303.20724-2-philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/ppc: fetch code with translator_ldEmilio G. Cota2019-10-281-5/+3Star
| | | | | | | Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* tcg: TCGMemOp is now accelerator independent MemOpTony Nguyen2019-09-031-6/+6
| | | | | | | | | | | | | | Preparation for collapsing the two byte swaps, adjust_endianness and handle_bswap, along the I/O path. Target dependant attributes are conditionalized upon NEED_CPU_H. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <81d9cd7d7f5aaadfa772d6c48ecee834e9cf7882.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-4.2-20190821' ↵Peter Maydell2019-08-211-1/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queue for 2019-08-21 First ppc and spapr pull request for qemu-4.2. Includes: * Some TCG emulation fixes and performance improvements * Support for the mffsl instruction in TCG * Added missing DPDES SPR * Some enhancements to the emulation of the XIVE interrupt controller * Cleanups to spapr MSI management * Some new suspend/resume infrastructure and a draft suspend implementation for spapr * New spapr hypercall for TPM communication (will be needed for secure guests under an Ultravisor) * Fix several memory leaks And a few other assorted fixes. # gpg: Signature made Wed 21 Aug 2019 08:24:44 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-4.2-20190821: (42 commits) ppc: Fix emulated single to double denormalized conversions ppc: Fix emulated INFINITY and NAN conversions ppc: conform to processor User's Manual for xscvdpspn ppc: Add support for 'mffsl' instruction target/ppc: Add Directed Privileged Door-bell Exception State (DPDES) SPR spapr/xive: Mask the EAS when allocating an IRQ spapr: Implement better workaround in spapr-vty device spapr/irq: Drop spapr_irq_msi_reset() spapr/pci: Free MSIs during reset spapr/pci: Consolidate de-allocation of MSIs ppc: remove idle_timer logic spapr: Implement ibm,suspend-me i386: use machine class ->wakeup method machine: Add wakeup method to MachineClass ppc/xive: Improve 'info pic' support ppc/xive: Provide silent escalation support ppc/xive: Provide unconditional escalation support ppc/xive: Provide escalation support ppc/xive: Provide backlog support ppc/xive: Implement TM_PULL_OS_CTX special command ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/ppc: move opcode decode tables to PowerPCCPUAlex Bennée2019-08-211-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The opcode decode tables aren't really part of the CPUPPCState but an internal implementation detail for the translator. This can cause problems with memcpy in cpu_copy as any table created during ppc_cpu_realize get written over causing a memory leak. To avoid this move the tables into PowerPCCPU which is better suited to hold internal implementation details. Attempts to fix: https://bugs.launchpad.net/qemu/+bug/1836558 Cc: 1836558@bugs.launchpad.net Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20190716121352.302-1-alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | icount: remove unnecessary gen_io_end callsPavel Dovgalyuk2019-08-201-13/+0Star
|/ | | | | | | | | | | Prior patch resets can_do_io flag at the TB entry. Therefore there is no need in resetting this flag at the end of the block. This patch removes redundant gen_io_end calls. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Message-Id: <156404429499.18669.13404064982854123855.stgit@pasha-Precision-3630-Tower> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@gmail.com>
* Include qemu/main-loop.h lessMarkus Armbruster2019-08-161-0/+1
| | | | | | | | | | | | | | | | | | | | In my "build everything" tree, changing qemu/main-loop.h triggers a recompile of some 5600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). It includes block/aio.h, which in turn includes qemu/event_notifier.h, qemu/notify.h, qemu/processor.h, qemu/qsp.h, qemu/queue.h, qemu/thread-posix.h, qemu/thread.h, qemu/timer.h, and a few more. Include qemu/main-loop.h only where it's needed. Touching it now recompiles only some 1700 objects. For block/aio.h and qemu/event_notifier.h, these numbers drop from 5600 to 2800. For the others, they shrink only slightly. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190812052359.30071-21-armbru@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* target/ppc: Use gen_io_start/end around DARNRichard Henderson2019-05-221-6/+15
| | | | | | | | | | Generating a random number counts as I/O, as it cannot be replayed and produce the same results. Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/ppc: Use tcg_gen_abs_tlRichard Henderson2019-05-141-44/+24Star
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190426' into stagingPeter Maydell2019-04-281-2/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add tcg_gen_extract2_*. Deal with overflow of TranslationBlocks. Respect access_type in io_readx. # gpg: Signature made Fri 26 Apr 2019 18:17:01 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20190426: cputlb: Fix io_readx() to respect the access_type tcg/arm: Restrict constant pool displacement to 12 bits tcg/ppc: Allow the constant pool to overflow at 32k tcg: Restart TB generation after out-of-line ldst overflow tcg: Restart TB generation after constant pool overflow tcg: Restart TB generation after relocation overflow tcg: Restart after TB code generation overflow tcg: Hoist max_insns computation to tb_gen_code tcg/aarch64: Support INDEX_op_extract2_{i32,i64} tcg/arm: Support INDEX_op_extract2_i32 tcg/i386: Support INDEX_op_extract2_{i32,i64} tcg: Use extract2 in tcg_gen_deposit_{i32,i64} tcg: Use deposit and extract2 in tcg_gen_shifti_i64 tcg: Add INDEX_op_extract2_{i32,i64} tcg: Implement tcg_gen_extract2_{i32,i64} Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tcg: Hoist max_insns computation to tb_gen_codeRichard Henderson2019-04-241-2/+2
| | | | | | | | | | | | | | | | | | | | In order to handle TB's that translate to too much code, we need to place the control of the length of the translation in the hands of the code gen master loop. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* | target/ppc: Style fixes for translate.cDavid Gibson2019-04-261-191/+313
|/ | | | | | Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
* qom/cpu: Simplify how CPUClass:cpu_dump_state() printsMarkus Armbruster2019-04-181-86/+85Star
| | | | | | | | | | | | | | | | | | | | CPUClass method dump_statistics() takes an fprintf()-like callback and a FILE * to pass to it. Most callers pass fprintf() and stderr. log_cpu_state() passes fprintf() and qemu_log_file. hmp_info_registers() passes monitor_fprintf() and the current monitor cast to FILE *. monitor_fprintf() casts it right back, and is otherwise identical to monitor_printf(). The callback gets passed around a lot, which is tiresome. The type-punning around monitor_fprintf() is ugly. Drop the callback, and call qemu_fprintf() instead. Also gets rid of the type-punning, since qemu_fprintf() takes NULL instead of the current monitor cast to FILE *. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190417191805.28198-15-armbru@redhat.com>
* qom/cpu: Simplify how CPUClass::dump_statistics() printsMarkus Armbruster2019-04-181-5/+4Star
| | | | | | | | | | | | | | | | CPUClass method dump_statistics() takes an fprintf()-like callback and a FILE * to pass to it. Its only caller hmp_info_cpustats() (via cpu_dump_statistics()) passes monitor_fprintf() and the current monitor cast to FILE *. monitor_fprintf() casts it right back, and is otherwise identical to monitor_printf(). The type-punning is ugly. Drop the callback, and call qemu_printf() instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190417191805.28198-13-armbru@redhat.com>
* target/ppc: Improve comment of bcctr used for spectre v2 mitigationGreg Kurz2019-03-291-1/+9
| | | | | | Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <155359567174.1794128.3183997593369465355.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Consolidate 64-bit server processor detection in a helperGreg Kurz2019-03-291-6/+4Star
| | | | | | | | | | | We use PPC_SEGMENT_64B in various places to guard code that is specific to 64-bit server processors compliant with arch 2.x. Consolidate the logic in a helper macro with an explicit name. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <155327783157.1283071.3747129891004927299.stgit@bahia.lan> Tested-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Enable "decrement and test CTR" version of bcctrGreg Kurz2019-03-291-15/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Even if all ISAs up to v3 indeed mention: If the "decrement and test CTR" option is specified (BO2=0), the instruction form is invalid. The UMs of all existing 64-bit server class processors say: If BO[2] = 0, the contents of CTR (before any update) are used as the target address and for the test of the contents of CTR to resolve the branch. The contents of the CTR are then decremented and written back to the CTR. The linux kernel has spectre v2 mitigation code that relies on a BO[2] = 0 variant of bcctr, which is now activated by default on spapr, even with TCG. This causes linux guests to panic with the default machine type under TCG. Since any CPU model can provide its own behaviour for invalid forms, we could possibly introduce a new instruction flag to handle this. In practice, since the behaviour is shared by all 64-bit server processors starting with 970 up to POWER9, let's reuse the PPC_SEGMENT_64B flag. Caveat: this may have to be fixed later if POWER10 introduces a different behaviour. The existing behaviour of throwing a program interrupt is kept for all other CPU models. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <155327782604.1283071.10640596307206921951.stgit@bahia.lan> Tested-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix TCG temporary leaks in gen_bcond()Greg Kurz2019-03-291-0/+2
| | | | | | | Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <155327782047.1283071.10234727692461848972.stgit@bahia.lan> Tested-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: improve avr64_offset() and use it to simplify ↵Mark Cave-Ayland2019-03-121-14/+2Star
| | | | | | | | | | | | | get_avr64()/set_avr64() By using the VsrD macro in avr64_offset() the same offset calculation can be used regardless of the host endian. This allows get_avr64() and set_avr64() to be simplified accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20190307180520.13868-6-mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: introduce single fpr_offset() functionMark Cave-Ayland2019-03-121-2/+2
| | | | | | | | | | Instead of having multiple copies of the offset calculation logic, move it to a single fpr_offset() function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20190307180520.13868-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Implement large decrementer support for TCGSuraj Jitindar Singh2019-03-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to POWER9 the decrementer was a 32-bit register which decremented with each tick of the timebase. From POWER9 onwards the decrementer can be set to operate in a mode called large decrementer where it acts as a n-bit decrementing register which is visible as a 64-bit register, that is the value of the decrementer is sign extended to 64 bits (where n is implementation dependant). The mode in which the decrementer operates is controlled by the LPCR_LD bit in the logical paritition control register (LPCR). >From POWER9 onwards the HDEC (hypervisor decrementer) was enlarged to h-bits, also sign extended to 64 bits (where h is implementation dependant). Note this isn't configurable and is always enabled. On POWER9 the large decrementer and hdec are both 56 bits, as represented by the lrg_decr_bits cpu class property. Since they are the same size we only add one property for now, which could be extended in the case they ever differ in the future. We also add the lrg_decr_bits property for POWER5+/7/8 since it is used to determine the size of the hdec, which is only generated on the POWER5+ processor and later. On these processors it is 32 bits. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190301024317.22137-2-sjitindarsingh@gmail.com> [dwg: Small style fixes] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Add POWER9 exception modelBenjamin Herrenschmidt2019-02-251-1/+2
| | | | | | | | | | And use it to get the correct HILE bit in HID0 Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190215161648.9600-7-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix support for "STOP light" states on POWER9Benjamin Herrenschmidt2019-02-251-1/+12
| | | | | | | | | | | | | | | | STOP must act differently based on PSSCR:EC on POWER9. When set, it acts like the P7/P8 power management instructions and wake up at 0x100 based on the wakeup conditions in LPCR. When PSSCR:EC is clear however it will wakeup at the next instruction after STOP (if EE is clear) or take the corresponding interrupts (if EE is set). Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190215161648.9600-4-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix nip on power management instructionsBenjamin Herrenschmidt2019-02-251-4/+8
| | | | | | | | | | | | | | | | | | | | Those instructions currently raise an exception from within the helper. This tends to result in a bogus nip value in the env context (typically the beginning of the TB). Such a helper needs a gen_update_nip() first. This fixes it with a different approach which is to throw the exception from translate.c instead of the helper using gen_exception_nip() which does the right thing. Exception EXCP_HLT is also used instead of POWERPC_EXCP_STOP to effectively exit from the CPU execution loop. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [clg : modified the commit log to comment the use of EXCP_HLT instead of POWERPC_EXCP_STOP] Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190215161648.9600-2-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: convert VMX logical instructions to use vector operationsMark Cave-Ayland2019-02-181-0/+1
| | | | | | | | Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190215100058.20015-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* ppc: fix crash during branch steppingRoman Kapl2019-02-171-22/+15Star
| | | | | | | | | | | | | | | | The PPC BRANCH exception could bubble up, but this is an QEMU internal exception and QEMU then crased. Instead it should trigger TRACE exception, according to PPC 2.07 book. It could happen only when using branch stepping, which is not commonly used. Change gen_prep_dbgex do do trigger TRACE. The excp, argument is now removed, since the type of exception can be inferred from the singlestep_enabled flags. removed the guards around gen_exception, since they are unnecessary. Fixes: 0e3bf48909 ("ppc: add DBCR based debugging"). Signed-off-by: Roman Kapl <rka@sysgo.com> Message-Id: <20190212121255.2279-1-rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Fix msync to do what hardware doesBALATON Zoltan2019-02-171-3/+8
| | | | | | | | | | | | | | | According to BookE docs, invalid bits (while undefined behaviour) should not raise exception but be ignored. This seems to be implementation dependent though and QEMU currently does what e500 CPUs do and raise exception for invalid bits. Unfortunately some versions of libstdc++ (and so all programs compiled with it) have lwsync on PPC440 which is invalid but on real hardware it's just executed as msync ignoring the invalid bits (maybe that's why it got undetected) but they fail on QEMU. This patch changes invalid mask of msync to allow these programs to run but keep generating exception on e500 cores to follow what hardware does. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: move FP and VMX registers into aligned vsr register arrayMark Cave-Ayland2019-01-081-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The VSX register array is a block of 64 128-bit registers where the first 32 registers consist of the existing 64-bit FP registers extended to 128-bit using new VSR registers, and the last 32 registers are the VMX 128-bit registers as show below: 64-bit 64-bit +--------------------+--------------------+ | FP0 | | VSR0 +--------------------+--------------------+ | FP1 | | VSR1 +--------------------+--------------------+ | ... | ... | ... +--------------------+--------------------+ | FP30 | | VSR30 +--------------------+--------------------+ | FP31 | | VSR31 +--------------------+--------------------+ | VMX0 | VSR32 +-----------------------------------------+ | VMX1 | VSR33 +-----------------------------------------+ | ... | ... +-----------------------------------------+ | VMX30 | VSR62 +-----------------------------------------+ | VMX31 | VSR63 +-----------------------------------------+ In order to allow for future conversion of VSX instructions to use TCG vector operations, recreate the same layout using an aligned version of the existing vsr register array. Since the old fpr and avr register arrays are removed, the existing callers must also be updated to use the correct offset in the vsr register array. This also includes switching the relevant VMState fields over to using subarrays to make sure that migration is preserved. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: switch FPR, VMX and VSX helpers to access data directly from cpu_envMark Cave-Ayland2019-01-081-43/+16Star
| | | | | | | | | | | Instead of accessing the FPR, VMX and VSX registers through static arrays of TCGv_i64 globals, remove them and change the helpers to load/store data directly within cpu_env. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: introduce get_avr64() and set_avr64() helpers for VMX register ↵Mark Cave-Ayland2019-01-081-0/+10
| | | | | | | | | | | | | | | access These helpers allow us to move AVR register values to/from the specified TCGv_i64 argument. To prevent VMX helpers accessing the cpu_avr{l,h} arrays directly, add extra TCG temporaries as required. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: introduce get_fpr() and set_fpr() helpers for FP register accessMark Cave-Ayland2019-01-081-0/+10
| | | | | | | | | | | | | These helpers allow us to move FP register values to/from the specified TCGv_i64 argument in the VSR helpers to be introduced shortly. To prevent FP helpers accessing the cpu_fpr array directly, add extra TCG temporaries as required. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: tcg: Implement addex instructionSuraj Jitindar Singh2018-12-201-27/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the addex instruction introduced in ISA V3.00 in qemu tcg. The add extended using alternate carry bit (addex) instruction performs the same operation as the add extended (adde) instruction, but using the overflow (ov) field in the fixed point exception register (xer) as the carry in and out instead of the carry (ca) field. The instruction has a Z23-form, not an XO form, as follows: ------------------------------------------------------------------ | 31 | RT | RA | RB | CY | 170 | 0 | ------------------------------------------------------------------ 0 6 11 16 21 23 31 32 However since the only valid form of the instruction defined so far is CY = 0, we can treat this like an XO form instruction. There is no dot form (addex.) of the instruction and the summary overflow (so) bit in the xer is not modified by this instruction. For simplicity we reuse the gen_op_arith_add function and add a function argument to specify where the carry in input should come from and the carry out output be stored (note must be the same location). Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* This patch fixes processing of rfi instructions in icount mode.Maria Klimushenkova2018-11-081-0/+12
| | | | | | | | | | | In this mode writing to interrupt/peripheral state is controlled by can_do_io flag. This flag must be set explicitly before helper function invocation. Signed-off-by: Maria Klimushenkova <maria.klimushenkova@ispras.ru> Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: fix mtmsr instruction for icountPavel Dovgalyuk2018-11-081-0/+12
| | | | | | | | | | | | This patch fixes processing of mtmsr instructions in icount mode. In this mode writing to interrupt/peripheral state is controlled by can_do_io flag. This flag must be set explicitly before helper function invocation. Signed-off-by: Maria Klimushenkova <maria.klimushenkova@ispras.ru> Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: add external PID supportRoman Kapl2018-11-081-0/+141
| | | | | | | | | | | | | | | | | | | | | | | External PID is a mechanism present on BookE 2.06 that enables application to store/load data from different address spaces. There are special version of some instructions, which operate on alternate address space, which is specified in the EPLC/EPSC regiser. This implementation uses two additional MMU modes (mmu_idx) to provide the address space for the load and store instructions. The QEMU TLB fill code was modified to recognize these MMU modes and use the values in EPLC/EPSC to find the proper entry in he PPC TLB. These two QEMU TLBs are also flushed on each write to EPLC/EPSC. Following instructions are implemented: dcbfep dcbstep dcbtep dcbtstep dcbzep dcbzlep icbiep lbepx ldepx lfdepx lhepx lwepx stbepx stdepx stfdepx sthepx stwepx. Following vector instructions are not: evlddepx evstddepx lvepx lvepxl stvepx stvepxl. Signed-off-by: Roman Kapl <rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* target/ppc: Convert to HAVE_CMPXCHG128 and HAVE_ATOMIC128Richard Henderson2018-10-191-56/+59
| | | | | Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* ppc: add DBCR based debuggingRoman Kapl2018-08-211-26/+81
| | | | | | | | | Add support for DBCR (debug control register) based debugging as used on BookE ppc. So far supports only branch and single-step events, but these are the important ones. GDB in Linux guest can now do single-stepping. Signed-off-by: Roman Kapl <rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-12-18 13:36:23 +0100