aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)AuthorFilesLines
2023-07-31target/openrisc: Set EPCR to next PC on FPE exceptionsStafford Horne1-3/+4
The architecture specification calls for the EPCR to be set to "Address of next not executed instruction" when there is a floating point exception (FPE). This was not being done, so fix it by using the same pattern as syscall. Also, we move this logic down to be done for instructions not in the delay slot as called for by the architecture manual. Without this patch FPU exceptions will loop, as the exception handling will always return back to the failed floating point instruction. This was not noticed in earlier testing because: 1. The compiler usually generates code which clobbers the input operand such as: lf.div.s r19,r17,r19 2. The target will store the operation output before to the register before handling the exception. So an operation such as: float a = 100.0f; float b = 0.0f; float c = a / b; /* lf.div.s r19,r17,r19 */ Will first execute: 100 / 0 -> Store inf to c (r19) -> triggering divide by zero exception -> handle and return Then it will execute: 100 / inf -> Store 0 to c (no exception) To confirm the looping behavior and the fix I used the following: float fpu_div(float a, float b) { float c; asm volatile("lf.div.s %0, %1, %2" : "+r" (c) : "r" (a), "r" (b)); return c; } Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Stafford Horne <shorne@gmail.com>
2023-07-31target/s390x: Move trans_exc_code update to do_program_interruptRichard Henderson1-12/+28
This solves a problem in which the store to LowCore during tlb_fill triggers a clean-page TB invalidation for page0 during translation, which results in an assertion failure for locked pages. By delaying the store until after the exception has been raised, we will have unwound the pages locked for translation and the problem does not arise. There are plenty of other updates to LowCore while delivering an interrupt/exception; trans_exc_code does not need to be special. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-31target/ppc: Disable goto_tb with architectural singlestepRichard Henderson1-0/+3
The change to use translator_use_goto_tb went too far, as the CF_SINGLE_STEP flag managed by the translator only handles gdb single stepping and not the architectural single stepping modeled in DisasContext.singlestep_enabled. Fixes: 6e9cc373ec5 ("target/ppc: Use translator_use_goto_tb") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1795 Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-31target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-armPeter Maydell1-3/+7
Currently we list all the Arm decodetree files together and add them unconditionally to arm_ss. This means we build them for both qemu-system-aarch64 and qemu-system-arm. However, some of them are AArch64-specific, so there is no need to build them for qemu-system-arm. (Meson is smart enough to notice that the generated .c.inc file is not used by any objects that go into qemu-system-arm, so we only unnecessarily run decodetree, not anything more heavyweight like a recompile or relink, but it's still unnecessary work.) Split gen into gen_a32 and gen_a64, and only add gen_a64 for TARGET_AARCH64 compiles. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230718104628.1137734-1-peter.maydell@linaro.org
2023-07-31target/arm: Avoid writing to constant TCGv in trans_CSEL()Peter Maydell1-7/+8
In commit 0b188ea05acb5 we changed the implementation of trans_CSEL() to use tcg_constant_i32(). However, this change was incorrect, because the implementation of the function sets up the TCGv_i32 rn and rm to be either zero or else a TCG temp created in load_reg(), and these TCG temps are then in both cases written to by the emitted TCG ops. The result is that we hit a TCG assertion: qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed. (or on a non-debug build, just produce a garbage result) Adjust the code so that rn and rm are always writeable temporaries whether the instruction is using the special case "0" or a normal register as input. Cc: qemu-stable@nongnu.org Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
2023-07-31target/arm: Fix MemOp for STGPRichard Henderson1-3/+18
When converting to decodetree, the code to rebuild mop for the pair only made it into trans_STP and not into trans_STGP. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1790 Fixes: 8c212eb6594 ("target/arm: Convert load/store-pair to decodetree") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230726165416.309624-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into stagingPeter Maydell33-59/+59
trivial-patches 25-07-2023 # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmS/2vgPHG1qdEB0bHMu # bXNrLnJ1AAoJEHAbT2saaT5ZT6MH/j5L3P9yLV6TqW+DkhCppbmBygqxz2SbQjwl # dVVfSLpJNbtpvLfEnvpb+ms+ZdaOCGj8IofAVf9w0VaIYJFP1srFphY/1x+RYVnw # kDjCLzuLNSCAdCV2HPqsrMKzdFctZ/MfK+QzfcGik9IvmCNPYWOhpmevs+xAIEJd # b0xk152zy2fIIC3vKK+3KcM7MFkqZWJ6z0pzUZAyEBS+aQyuZNPJ/cO8xMXotbP2 # jqv12SNGV2GLH1acvsd8GQwDB9MamstB4r8NWpSpT/AyPwOgmMR+j5B8a/WEBJCs # OcEW/pEyrumSygqf9z01YoNJQUCSvSpg5aq4+S2cRDslmUgFDmw= # =wCoQ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 25 Jul 2023 15:23:52 BST # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: issuer "mjt@tls.msk.ru" # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [full] # gpg: aka "Michael Tokarev <mjt@debian.org>" [full] # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: qapi: Correct "eg." to "e.g." in documentation hw/pci: add comment to explain checking for available function 0 in pci hotplug target/tricore: Rename tricore_feature hw/9pfs: spelling fixes other architectures: spelling fixes arm: spelling fixes s390x: spelling fixes migration: spelling fixes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25Merge tag 'misc-fixes-20230725' of https://github.com/philmd/qemu into stagingPeter Maydell10-49/+64
Misc patches queue hw/sd/sdhci: Default I/O ops to little endian hw/mips/loongson3-virt: Only use default USB if available hw/char/escc: Implement loopback mode to allow self-testing target/mips: Avoid overruns and shifts by negative number target/sparc: Handle FPRS correctly on big-endian hosts target/tricore: Rename tricore_feature to avoid clash with libcapstone # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmS/4ksACgkQ4+MsLN6t # wN6OSg//cZY9C6fRXNNaIqkmnhjbaV6KLtjE7mOKp0RUyh3aN0dtTwWIjdJc0O5C # iipHESYhcbHTiN/TxK0zXg4KgtKmtwqGsa3QTXGdTlSkTY/dMNioSpb7p82becu0 # fhCvGRLJ97j7/mhebiBNT/urrcG5h3n7CjA5IoFMMA4f+cajsGZHwmq5TTzc2ehy # 4FuchjFUw+cgqU1peNYoqt2dfnxFg0EgKBSRikl8MyPf9lFzTlXOKbgd+qppG6hI # 2fAUHyMqBkU22sAoK0eB0077LjgjPPQfmn8UPGkpGD5QZQcvBRNArg4fyHxCKTS7 # zOsO1Qc+4D2l2RJlIHgct2pmcHdT29TlTn2T4Lg900Hm09KelZh1XF+1BemCC13z # cGWjPcYozvGFFiHlhazINtbGpB6XaP/Z3OwroRHRn+Mn3ss+FaU+j/p+4YlEVyFi # 4yoEyjhNma6/hssmstifSQsaOf6XthzpS+XdKNB6G1b2WuRSc1Z59b2gcPBTwbXY # B52lfI61nzSrP9pLuS8c/6hQXQvADIEndeWEcWZ50h3WW2Cemj9jTDVgfjWC4Vg9 # wV2U6NeTr+g54cSU5vcKiZrqsQHUoLiKbZFRJkXF7EEMbOErIQnyIS5l8xf71Pay # YPxuPf1VprRiR07d+ZaA+wmEaBxLCUPEl1CEuu5NPVA9S4yIIWE= # =F+Wb # -----END PGP SIGNATURE----- # gpg: Signature made Tue 25 Jul 2023 15:55:07 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'misc-fixes-20230725' of https://github.com/philmd/qemu: target/tricore: Rename tricore_feature target/sparc: Handle FPRS correctly on big-endian hosts target/mips: Avoid shift by negative number in page_table_walk_refill() target/mips: Pass directory/leaf shift values to walk_directory() target/mips/mxu: Avoid overrun in gen_mxu_q8adde() target/mips/mxu: Avoid overrun in gen_mxu_S32SLT() target/mips/mxu: Replace magic array size by its definition hw/char/escc: Implement loopback mode hw/mips: Improve the default USB settings in the loongson3-virt machine hw/sd/sdhci: Do not force sdhci_mmio_*_ops onto all SD controllers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25target/tricore: Rename tricore_featureBastian Koppelmann4-9/+9
this name is used by capstone and will lead to a build failure of QEMU, when capstone is enabled. So we rename it to tricore_has_feature(), to match has_feature() in translate.c. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1774 Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-07-25other architectures: spelling fixesMichael Tokarev18-41/+41
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25arm: spelling fixesMichael Tokarev10-13/+13
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25s390x: spelling fixesMichael Tokarev5-5/+5
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Thomas Huth <thuth@redhat.com>
2023-07-25target/tricore: Rename tricore_featureBastian Koppelmann4-9/+9
this name is used by capstone and will lead to a build failure of QEMU, when capstone is enabled. So we rename it to tricore_has_feature(), to match has_feature() in translate.c. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1774 Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230721060605.76636-1-kbastian@mail.uni-paderborn.de>
2023-07-25target/sparc: Handle FPRS correctly on big-endian hostsPeter Maydell4-5/+6
In CPUSparcState we define the fprs field as uint64_t. However we then refer to it in translate.c via a TCGv_i32 which we set up with tcg_global_mem_new_ptr(). This means that on a big-endian host when the guest does something to writo te the FPRS register this value ends up in the wrong half of the uint64_t, and the QEMU C code that refers to env->fprs sees the wrong value. The effect of this is that guest code that enables the FPU crashes with spurious FPU Disabled exceptions. In particular, this is why tests/avocado/machine_sparc64_sun4u.py:Sun4uMachine.test_sparc64_sun4u times out on an s390 host. There are multiple ways we could fix this; since there are actually only three bits in the FPRS register and the code in translate.c would be a bit painful to convert to dealing with a TCGv_i64, change the type of the CPU state struct field to match what translate.c is expecting. (None of the other fields referenced by the r32[] array in sparc_tcg_init() have the wrong type.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20230717103544.637453-1-peter.maydell@linaro.org>
2023-07-25target/mips: Avoid shift by negative number in page_table_walk_refill()Peter Maydell1-15/+17
Coverity points out that in page_table_walk_refill() we can shift by a negative number, which is undefined behaviour (CID 1452918, 1452920, 1452922). We already catch the negative directory_shift and leaf_shift as being a "bail out early" case, but not until we've already used them to calculated some offset values. The shifts can be negative only if ptew > 1, so make the bail-out-early check look directly at that, and only calculate the shift amounts and the offsets based on them after we have done that check. This allows us to simplify the expressions used to calculate the shift amounts, use an unsigned type, and avoids the undefined behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> [PMD: Check for ptew > 1, use unsigned type] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230717213504.24777-3-philmd@linaro.org>
2023-07-25target/mips: Pass directory/leaf shift values to walk_directory()Philippe Mathieu-Daudé1-10/+8
We already evaluated directory_shift and leaf_shift in page_table_walk_refill(), no need to do that again: pass as argument. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230717213504.24777-2-philmd@linaro.org>
2023-07-25target/mips/mxu: Avoid overrun in gen_mxu_q8adde()Philippe Mathieu-Daudé1-8/+18
Coverity reports a potential overruns (CID 1517770): Overrunning array "mxu_gpr" of 15 8-byte elements at element index 4294967295 (byte offset 34359738367) using index "XRb - 1U" (which evaluates to 4294967295). Add a gen_extract_mxu_gpr() helper similar to gen_load_mxu_gpr() to safely extract MXU registers. Fixes: eb79951ab6 ("target/mips/mxu: Add Q8ADDE ... insns") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230712060806.82323-4-philmd@linaro.org>
2023-07-25target/mips/mxu: Avoid overrun in gen_mxu_S32SLT()Philippe Mathieu-Daudé1-2/+6
Coverity reports a potential overrun (CID 1517769): Overrunning array "mxu_gpr" of 15 8-byte elements at element index 4294967295 (byte offset 34359738367) using index "XRb - 1U" (which evaluates to 4294967295). Use gen_load_mxu_gpr() to safely load MXU registers. Fixes: ff7936f009 ("target/mips/mxu: Add S32SLT ... insns") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230712060806.82323-3-philmd@linaro.org>
2023-07-25target/mips/mxu: Replace magic array size by its definitionPhilippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230712060806.82323-2-philmd@linaro.org>
2023-07-25Merge tag 'pull-target-arm-20230725' of ↵Peter Maydell1-6/+12
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * tests/decode: Suppress "error: " string for expected-failure tests * ui/curses: For curses display, recognize a few more control keys * target/arm: Special case M-profile in debug_helper.c code * scripts/git-submodule.sh: Don't rely on non-POSIX 'read' behaviour * hw/arm/smmu: Handle big-endian hosts correctly # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmS/ot8ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3slqEACaLJwIYl1bJBfCda2u53+C # q20t50SQjkvV2CSW6A9uOHPPahKUcxAXh6K+d54BhzD6Dsrv5g1rpo/2fnNhHDSG # 7fHlla+fPnywmAOahE2FPUw4pckRX1tpPIM1RDjM9szLYqkJlShKYP28QsLu1Eku # bnTty6OcId5hAZILag53QLwL9EYsVYoCEe6xRcgY3He0UZcCEisCUdfeCXEN1Uc8 # 57wd+q3KNUTgOScqmDJRAH2NaET0UOYlUvQGVu8/Bh3t0huQCtfyT4gc8z7v/TZ8 # 2PfI6bFb9nei09avxhBMN9Nu7BVD6eHBkAAe4JHDBhkJKCZn+LASDCMUAFPrFD2V # NeIObNHBMaE9FqIG/SZxf7kEOaFcUwt4GrVfQNguaqiXIwALsfT/jiX4r+jXX4WS # ii0mdoS2ZuAcRtUhTA7S6x44B3wa47sidSogoe3t2k8ObYB/AZ34F1cSZDgEmIG7 # nobJE2OgzSRMWUHXhCUEzGvn8MMPeI0HQmKr4sOD6CnlqHIzLZDH4Jx0DL4yvoyc # XLs0D2G4yscUTtWh15R/nTWTJKxjumbs05bqwRKLTMsVj6kpDDY/EqhHMvB6Xm70 # z+xDGki9xsBOTGRO7GdqGlWEKfnwUIPjipwy9crhsjSe121XrP8uwmmDBL1tOLgc # L+geqtruzJgFmo3rOBGxXA== # =4paq # -----END PGP SIGNATURE----- # gpg: Signature made Tue 25 Jul 2023 11:24:31 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20230725' of https://git.linaro.org/people/pmaydell/qemu-arm: tests/decode: Suppress "error: " string for expected-failure tests For curses display, recognize a few more control keys target/arm: Special case M-profile in debug_helper.c code scripts/git-submodule.sh: Don't rely on non-POSIX 'read' behaviour hw/arm/smmu: Handle big-endian hosts correctly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-25target/arm: Special case M-profile in debug_helper.c codePeter Maydell1-6/+12
A lot of the code called from helper_exception_bkpt_insn() is written assuming A-profile, but we will also call this helper on M-profile CPUs when they execute a BKPT insn. This used to work by accident, but recent changes mean that we will hit an assert when some of this code calls down into lower level functions that end up calling arm_security_space_below_el3(), arm_el_is_aa64(), and other functions that now explicitly assert that the guest CPU is not M-profile. Handle M-profile directly to avoid the assertions: * in arm_debug_target_el(), M-profile debug exceptions always go to EL1 * in arm_debug_exception_fsr(), M-profile always uses the short format FSR (compare commit d7fe699be54b2, though in this case the code in arm_v7m_cpu_do_interrupt() does not need to look at the FSR value at all) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1775 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230721143239.1753066-1-peter.maydell@linaro.org
2023-07-24target/loongarch: Fix the CSRRD CPUID instruction on big endian hostsThomas Huth4-7/+12
The test in tests/avocado/machine_loongarch.py is currently failing on big endian hosts like s390x. By comparing the traces between running the QEMU_EFI.fd bios on a s390x and on a x86 host, it's quickly obvious that the CSRRD instruction for the CPUID is behaving differently. And indeed: The code currently does a long read (i.e. 64 bit) from the address that points to the CPUState->cpu_index field (with tcg_gen_ld_tl() in the trans_csrrd() function). But this cpu_index field is only an "int" (i.e. 32 bit). While this dirty pointer magic works on little endian hosts, it of course fails on big endian hosts. Fix it by using a proper helper function instead. Message-Id: <20230720175307.854460-1-thuth@redhat.com> Reviewed-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Fix assertion failure in VFMIN/VFMAX with type 13Ilya Leoshkevich1-1/+1
Type 13 is reserved, so using it should result in specification exception. Due to an off-by-1 error the code triggers an assertion at a later point in time instead. Cc: qemu-stable@nongnu.org Fixes: da4807527f3b ("s390x/tcg: Implement VECTOR FP (MAXIMUM|MINIMUM)") Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-8-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Make MC raise specification exception when class >= 16Ilya Leoshkevich2-3/+3
MC requires bit positions 8-11 (upper 4 bits of class) to be zeros, otherwise it must raise a specification exception. Cc: qemu-stable@nongnu.org Fixes: 20d143e2cab8 ("s390x/tcg: Implement MONITOR CALL") Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-6-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Fix ICM with M3=0Ilya Leoshkevich1-0/+6
When the mask is zero, access exceptions should still be recognized for 1 byte at the second-operand address. CC should be set to 0. Cc: qemu-stable@nongnu.org Fixes: e023e832d0ac ("s390x: translate engine for s390x CPU") Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-5-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Fix CONVERT TO LOGICAL/FIXED with out-of-range inputsIlya Leoshkevich1-1/+2
CONVERT TO LOGICAL/FIXED deviate from IEEE 754 in that they raise an inexact exception on out-of-range inputs. float_flag_invalid_cvti aligns nicely with that behavior, so convert it to S390_IEEE_MASK_INEXACT. Cc: qemu-stable@nongnu.org Fixes: defb0e3157af ("s390x: Implement opcode helpers") Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Fix CLM with M3=0Ilya Leoshkevich1-0/+5
When the mask is zero, access exceptions should still be recognized for 1 byte at the second-operand address. CC should be set to 0. Cc: qemu-stable@nongnu.org Fixes: defb0e3157af ("s390x: Implement opcode helpers") Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-24target/s390x: Make CKSM raise an exception if R2 is oddIlya Leoshkevich2-1/+7
R2 designates an even-odd register pair; the instruction should raise a specification exception when R2 is not even. Cc: qemu-stable@nongnu.org Fixes: e023e832d0ac ("s390x: translate engine for s390x CPU") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230724082032.66864-2-iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-19target/riscv: Fix LMUL check to use VLENRob Bradford1-2/+2
The previous check was failing with: VLEN=128 ELEN = 64 SEW = 16 and LMUL = 1/8 which is a valid combination. Fix the check to allow valid combinations when VLEN is a multiple of ELEN. From the specification: "In general, the requirement is to support LMUL ≥ SEWMIN/ELEN, where SEWMIN is the narrowest supported SEW value and ELEN is the widest supported SEW value. In the standard extensions, SEWMIN=8. For standard vector extensions with ELEN=32, fractional LMULs of 1/2 and 1/4 must be supported. For standard vector extensions with ELEN=64, fractional LMULs of 1/2, 1/4, and 1/8 must be supported." Elsewhere in the specification it makes clear that VLEN>=ELEN. From inspection this new check allows: VLEN=ELEN=64 1/2, 1/4, 1/8 for SEW >=8 VLEN=ELEN=32 1/2, 1/4 for SEW >=8 Fixes: d9b7609a1fb2 ("target/riscv: rvv-1.0: configure instructions") Signed-off-by: Rob Bradford <rbradford@rivosinc.com> Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn> Message-Id: <20230718131316.12283-2-rbradford@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-07-19target/riscv/cpu.c: check priv_ver before auto-enable zca/zcd/zcfDaniel Henrique Barboza1-1/+2
Commit bd30559568 made changes in how we're checking and disabling extensions based on env->priv_ver. One of the changes was to move the extension disablement code to the end of realize(), being able to disable extensions after we've auto-enabled some of them. An unfortunate side effect of this change started to happen with CPUs that has an older priv version, like sifive-u54. Starting on commit 2288a5ce43e5 we're auto-enabling zca, zcd and zcf if RVC is enabled, but these extensions are priv version 1.12.0. When running a cpu that has an older priv ver (like sifive-u54) the user is spammed with warnings like these: qemu-system-riscv64: warning: disabling zca extension for hart 0x0000000000000000 because privilege spec version does not match qemu-system-riscv64: warning: disabling zcd extension for hart 0x0000000000000000 because privilege spec version does not match The warnings are part of the code that disables the extension, but in this case we're throwing user warnings for stuff that we enabled on our own, without user intervention. Users are left wondering what they did wrong. A quick 8.1 fix for this nuisance is to check the CPU priv spec before auto-enabling zca/zcd/zcf. A more appropriate fix will include a more robust framework that will account for both priv_ver and user choice when auto-enabling/disabling extensions, but for 8.1 we'll make it do with this simple check. It's also worth noticing that this is the only case where we're auto-enabling extensions based on a criteria (in this case RVC) that doesn't match the priv spec of the extensions we're enabling. There's no need for more 8.1 band-aids. Cc: Conor Dooley <conor@kernel.org> Fixes: 2288a5ce43e5 ("target/riscv: add cfg properties for Zc* extension") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn> Tested-by: Conor Dooley <conor.dooley@microchip.com> Message-Id: <20230717154141.60898-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-07-17target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bitsPeter Maydell1-5/+8
In get_phys_addr_twostage() the code that applies the effects of VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure. Now we also have f.attrs.space for FEAT_RME, we need to keep the two in sync. These bits only have an effect for Secure space translations, not for Root, so use the input in_space field to determine whether to apply them rather than the input is_secure. This doesn't actually make a difference because Root translations are never two-stage, but it's a little clearer. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
2023-07-17target/arm: Fix S1_ptw_translate() debug pathPeter Maydell1-5/+32
In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate() so that the debug-access "call get_phys_addr_*" codepath is used both when S1 is doing ptw reads from stage 2 and when it is doing ptw reads from physical memory. However, we didn't update the calculation of s2ptw->in_space and s2ptw->in_secure to account for the "ptw reads from physical memory" case. This meant that debug accesses when in Secure state broke. Create a new function S2_security_space() which returns the correct security space to use for the ptw load, and use it to determine the correct .in_secure and .in_space fields for the stage 2 lookup for the ptw load. Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate") Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-17target/arm/ptw.c: Add comments to S1Translate struct fieldsPeter Maydell1-0/+40
Add comments to the in_* fields in the S1Translate struct that explain what they're doing. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
2023-07-15accel/tcg: Return bool from page_check_rangeRichard Henderson3-3/+3
Replace the 0/-1 result with true/false. Invert the sense of the test of all callers. Document the function. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-25-richard.henderson@linaro.org>
2023-07-11Merge tag 'mips-20230710' of https://github.com/philmd/qemu into stagingRichard Henderson16-132/+3962
MIPS patches queue - Use clock API & divider for cp0_timer to avoid rounding issue (Jiaxun) - Implement Loongson CSR instructions (Jiaxun) - Implement Ingenic MXU ASE v1 rev2 (Siarhei) - Enable GINVx support for I6400 and I6500 cores (Marcin) - Generalize PCI IDE controller models (Bernhard) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmSsg5kACgkQ4+MsLN6t # wN6O4g/9GpirNnG1tizIEksI17PaAotgui2PYzml2nQLyQNmPs3lSfyDEfFpZLC6 # HGxglNjdvCgmIhRH1IuRKuJofp0r84NY+sktXjz2+As3opyjR66gVsSefWeupr7t # avZQQIBBOV3OYLzFkqjDpBflyKXz43MRW3r9ai4Dle/TwiE5GA1iKuQ6Rt55urtT # 045OdtFZTsIwTyg75pSXExAehOn5FQ4aqIODwfJYqvhkkVZ9lgWYSgUOsgDcGqPQ # eytpif6+m350Xme4BgqITMZkeIbyKcCcfU37JBqk/q6/gDDf18zSWpC7MNXea4ZR # so9ffZqms/xcIOfIO3uc4t9AZRHchiVjFHihCUKc0mBTzLy1QhQ4ybdQu3fUywaG # WziEFLrJ/qfWjixRxeDdBZamC2fSxYtcRNST7g+XttiMacvQC6aPFVfLDa+3Xjtt # TmIjx8oGdLB9BMrGMuHsOygfgi98eGbWQ2I5ZhzwBbJ7uFQdeTkMCswcAsVcj8pW # e7/ixw2e+SYFm0q9Z/QiZZ7LFDp/b3u7/ufXCUBX2r1gi7Xi+x60E6dm3Ge3XAsY # qSx9ZOlVNJlIs/ChP0KckHDMeFuCnRmNEvKC039syHWSy6VP8NO7fwwxK+XytyrK # aJMyPS97kVXuqriKZIGsV0KjLOz3neh0OdQTolPv1R5yb9tI6Xc= # =rtlE # -----END PGP SIGNATURE----- # gpg: Signature made Mon 10 Jul 2023 11:18:01 PM BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'mips-20230710' of https://github.com/philmd/qemu: (44 commits) hw/ide/piix: Move registration of VMStateDescription to DeviceClass hw/ide/pci: Replace some magic numbers by constants hw/ide: Extract bmdma_status_writeb() hw/ide: Extract IDEBus assignment into bmdma_init() hw/isa/vt82c686: Remove via_isa_set_irq() hw/ide/via: Wire up IDE legacy interrupts in host device hw/ide/pci: Expose legacy interrupts as named GPIOs target/mips: enable GINVx support for I6400 and I6500 target/mips/mxu: Add Q8SAD instruction target/mips/mxu: Add S32SFL instruction target/mips/mxu: Add Q8MADL instruction target/mips/mxu: Add Q16SCOP instruction target/mips/mxu: Add Q8MAC Q8MACSU instructions target/mips/mxu: Add S32/D16/Q8- MOVZ/MOVN instructions target/mips/mxu: Add D32/Q16- SLLV/SLRV/SARV instructions target/mips/mxu: Add Q16SLL Q16SLR Q16SAR instructions target/mips/mxu: Add D32SLL D32SLR D32SAR instructions target/mips/mxu: Add D32SARL D32SARW instructions target/mips/mxu: Add S32ALN S32LUI insns target/mips/mxu: Add S32MUL S32MULU S32EXTR S32EXTRV insns ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-10target/mips: enable GINVx support for I6400 and I6500Marcin Nowakowski1-2/+2
GINVI and GINVT operations are supported on MIPS I6400 and I6500 cores, so indicate that properly in CP0.Config5 register bits [16:15]. Cc: qemu-stable@nongnu.org Signed-off-by: Marcin Nowakowski <marcin.nowakowski@fungible.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230630072806.3093704-1-marcin.nowakowski@fungible.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add Q8SAD instructionSiarhei Volkau1-0/+45
The instruction implements SAD (sum-absolute-difference) operation which is used in motion estimation algorithms. The instruction handles four 8-bit data in parallel. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-34-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S32SFL instructionSiarhei Volkau1-0/+81
The instruction shuffles 8 bytes in two registers by one of 4 predefined patterns. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-33-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add Q8MADL instructionSiarhei Volkau1-0/+75
The instruction is used to parallel multiply and accumulate four 8-bit data. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-32-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add Q16SCOP instructionSiarhei Volkau1-0/+85
The instruction is used to determine sign of four 16-bit packed data in parallel. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-31-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add Q8MAC Q8MACSU instructionsSiarhei Volkau1-42/+86
These instructions do parallel quad 8-bit multiply and accumulate. They are close to existing Q8MUL Q8MULSU so the generation function modified to support all of them. Also the patch fixes decoding of Q8MULSU according to tests on hardware. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-30-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S32/D16/Q8- MOVZ/MOVN instructionsSiarhei Volkau1-0/+188
These instructions are: - single 32-bit - dual 16-bit packed - quad 8-bit packed conditional moves. They are grouped in pool20 in the source code. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-29-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add D32/Q16- SLLV/SLRV/SARV instructionsSiarhei Volkau1-4/+162
These instructions are counterparts for D32/Q16-SLL/SLR/SAR with difference that the shift amount placed into GPR. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-28-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add Q16SLL Q16SLR Q16SAR instructionsSiarhei Volkau1-0/+78
These instructions are same data shift in various directions, thus one generation function is implemented for all three. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-27-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add D32SLL D32SLR D32SAR instructionsSiarhei Volkau1-0/+55
These instructions are same data shift in various directions, thus one generation function is implemented for all three. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-26-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add D32SARL D32SARW instructionsSiarhei Volkau1-0/+59
These instructions are dual 32-bit arithmetic shift right and pack LSBs to 2x 16-bit into a MXU register. The difference is the shift amount source: immediate or GP reg. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-25-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S32ALN S32LUI insnsSiarhei Volkau1-1/+121
These instructions are part of pool16, see the grand opcode organization tree on top of the file. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-24-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S32MUL S32MULU S32EXTR S32EXTRV insnsSiarhei Volkau1-4/+196
These instructions are part of pool15, see the grand opcode organization tree on top of the file. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-23-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S16LDD S16STD S16LDI S16SDI instructionsSiarhei Volkau1-0/+117
These instructions are all load/store a halfword from memory and put it into/get it from MXU register in various combinations. I-suffix instructions modify the base address GPR by offset provided. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-22-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-10target/mips/mxu: Add S8STD S8LDI S8SDI instructionsSiarhei Volkau1-2/+72
These instructions are all load/store a byte from memory and put it into/get it from MXU register in various combinations. I-suffix instructions modify the base address GPR by offset provided. Signed-off-by: Siarhei Volkau <lis8215@gmail.com> Message-Id: <20230608104222.1520143-21-lis8215@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
generated by cgit v1.1 at 2025-09-20 04:45:27 +0000