aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)AuthorFilesLines
2023-06-05*: Add missing includes of tcg/tcg.hRichard Henderson2-0/+4
This had been pulled in from exec/cpu_ldst.h, via exec/exec-all.h, but the include of tcg.h will be removed. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-05target/*: Add missing includes of tcg/debug-assert.hRichard Henderson4-0/+4
This had been pulled in from tcg/tcg.h, via exec/cpu_ldst.h, via exec/exec-all.h, but the include of tcg.h will be removed. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-05target/avr: Add missing includes of qemu/error-report.hRichard Henderson1-0/+1
This had been pulled in from tcg/tcg.h, via exec/cpu_ldst.h, via exec/exec-all.h, but the include of tcg.h will be removed. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-30target/arm: Explain why we need to select ARM_V7MFabiano Rosas1-0/+3
We currently need to select ARM_V7M unconditionally when TCG is present in the build because some translate.c helpers and the whole of m_helpers.c are not yet under CONFIG_ARM_V7M. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230523180525.29994-2-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30target/arm: Explicitly select short-format FSR for M-profilePeter Maydell1-2/+11
For M-profile, there is no guest-facing A-profile format FSR, but we still use the env->exception.fsr field to pass fault information from the point where a fault is raised to the code in arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile specific fault status registers. So it doesn't matter whether we fill in env->exception.fsr in the short format or the LPAE format, as long as both sides agree. As it happens arm_v7m_cpu_do_interrupt() assumes short-form. In compute_fsr_fsc() we weren't explicitly choosing short-form for M-profile, but instead relied on it falling out in the wash because arm_s1_regime_using_lpae_format() would be false. This was broken in commit 452c67a4 when we added v8R support, because we said "PMSAv8 is always LPAE format" (as it is for v8R), forgetting that we were implicitly using this code path on M-profile. At that point we would hit a g_assert_not_reached(): ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached #7 0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549 #8 0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c) at ../../target/arm/tlb_helper.c:95 #9 0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90) at ../../target/arm/tlb_helper.c:132 #10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0) at ../../target/arm/tlb_helper.c:260 The specific assertion changed when commit fcc7404eff24b4c added "assert not M-profile" to arm_is_secure_below_el3(), because the conditions being checked in compute_fsr_fsc() include arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3() and asserting before we try to call arm_fi_to_lfsc(): #7 0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396 #8 0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448 #9 0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509 #10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c) Avoid the assertion and the incorrect FSR format selection by explicitly making M-profile use the short-format in this function. Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658 Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
2023-05-28target/ppc: Add POWER9 DD2.2 modelNicholas Piggin3-3/+23
POWER9 DD2.1 and earlier had significant limitations when running KVM, including lack of "mixed mode" MMU support (ability to run HPT and RPT mode on threads of the same core), and a translation prefetch issue which is worked around by disabling "AIL" mode for the guest. These processors are not widely available, and it's difficult to deal with all these quirks in qemu +/- KVM, so create a POWER9 DD2.2 CPU and make it the default POWER9 CPU. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Message-Id: <20230515160201.394587-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28target/ppc: Merge COMPUTE_CLASS and COMPUTE_FPRFRichard Henderson1-56/+22
Instead of computing an artificial "class" bitmask then converting that to the fprf value, compute the final value from the start. Reorder the tests to check the most likely cases first. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230523202507.688859-1-richard.henderson@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28target/ppc: Use SMT4 small core chip type in POWER9/10 PVRsNicholas Piggin1-3/+3
QEMU's PVR value for POWER9 DD2.0 has chip type 1, which is the SMT4 "small core" type that OpenPOWER processors use. QEMU's PVR for all other POWER9/10 have chip type 0, which "enterprise" systems use. The difference does not really matter to QEMU (because it does not care about SMT mode in the target), but for consistency all PVRs should use the same chip type. We'll go with the SMT4 OpenPOWER type. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230515160131.394562-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28spapr: Add SPAPR_CAP_AIL_MODE_3 for AIL mode 3 support for H_SET_MODE hcallNicholas Piggin2-0/+13
The behaviour of the Address Translation Mode on Interrupt resource is not consistently supported by all CPU versions or all KVM versions: KVM HV does not support mode 2, and does not support mode 3 on POWER7 or early POWER9 processesors. KVM PR only supports mode 0. TCG supports all modes (0, 2, 3) on CPUs with support for the corresonding LPCR[AIL] mode. This leads to inconsistencies in guest behaviour and could cause problems migrating guests. This was not noticable for Linux guests for a long time because the kernel only uses modes 0 and 3, and it used to consider AIL-3 to be advisory in that it would always keep the AIL-0 vectors around, so it did not matter whether or not interrupts were delivered according to the AIL mode. Recent Linux guests depend on AIL mode 3 working as specified in order to support the SCV facility interrupt. If AIL-3 can not be provided, then H_SET_MODE must return an error to Linux so it can disable the SCV facility (failure to do so can lead to userspace being able to crash the guest kernel). Add the ail-mode-3 capability to specify that AIL-3 is supported. AIL-0 is implied as the baseline, and AIL-2 is no longer supported by spapr. AIL-2 is not known to be used by any software, but support in TCG could be restored with an ail-mode-2 capability quite easily if a regression is reported. Modify the H_SET_MODE Address Translation Mode on Interrupt resource handler to check capabilities and correctly return error if not supported. KVM has a cap to advertise support for AIL-3. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20230515160216.394612-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-27target/ppc: Alignment faults do not set DSISR in ISA v3.0 onwardNicholas Piggin1-7/+10
This optional behavior was removed from the ISA in v3.0, see Summary of Changes preface: Data Storage Interrupt Status Register for Alignment Interrupt: Simplifies the Alignment interrupt by remov- ing the Data Storage Interrupt Status Register (DSISR) from the set of registers modified by the Alignment interrupt. Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20230515092655.171206-5-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-27target/ppc: Fix width of some 32-bit SPRsNicholas Piggin6-27/+27
Some 32-bit SPRs are incorrectly implemented as 64-bits on 64-bit targets. This changes VRSAVE, DSISR, HDSISR, DAWRX0, PIDR, LPIDR, DEXCR, HDEXCR, CTRL, TSCR, MMCRH, and PMC[1-6] from to be 32-bit registers. This only goes by the 32/64 classification in the architecture, it does not try to implement finer details of SPR implementation (e.g., not all bits implemented as simple read/write storage). Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Message-Id: <20230515092655.171206-2-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-27target/ppc: Fix fallback to MFSS for MFFS* instructions on pre 3.0 ISAsRichard Purdie2-13/+29
The following commits changed the code such that the fallback to MFSS for MFFSCRN, MFFSCRNI, MFFSCE and MFFSL on pre 3.0 ISAs was removed and became an illegal instruction: bf8adfd88b547680aa857c46098f3a1e94373160 - target/ppc: Move mffscrn[i] to decodetree 394c2e2fda70da722f20fb60412d6c0ca4bfaa03 - target/ppc: Move mffsce to decodetree 3e5bce70efe6bd1f684efbb21fd2a316cbf0657e - target/ppc: Move mffsl to decodetree The hardware will handle them as a MFFS instruction as the code did previously. This means applications that were segfaulting under qemu when encountering these instructions which is used in glibc libm functions for example. The fallback for MFFSCDRN and MFFSCDRNI added in a later patch was also missing. This patch restores the fallback to MFSS for these instructions on pre 3.0s ISAs as the hardware decoder would, fixing the segfaulting libm code. It doesn't have the fallback for 3.0 onwards to match hardware behaviour. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Reviewed-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230510111913.1718734-1-richard.purdie@linuxfoundation.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-26Merge tag 'pull-hex-20230526' of https://github.com/quic/qemu into stagingRichard Henderson10-89/+87
Hexagon update # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEENjXHiM5iuR/UxZq0ewJE+xLeRCIFAmRwv6QACgkQewJE+xLe # RCLRvQf/e0utA8/KAYwmay4dYiiVlrtJ4UVpwogQ8JC7je5H2+Gv633P4BF8uGAF # HmhdUk031jvG/BvKGH+493ESKgtIX3caLxJInPtYu3elqKxZhqKpke2VPF3srrwI # Mli8IqdwE2scSilG591xTjhU8vBGSm+hiQptSg9OaSotVcH8Qc/32+vudnr2JZtK # ko3MqISMW/KvfD+x47UcX4IX4bmQfDyysQITQs9lfwYgzv/4drl6/7CUFQZ3b8Go # Rz4ClbYhKT8YybJjX+yaKuTaHSrL9r0+90ORzYisEYcPiOOChmy9vv4HbZ1zTCbY # MVJM69IPdZDi1quE00jULYEEPrHRoA== # =vczK # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 07:18:12 AM PDT # gpg: using RSA key 3635C788CE62B91FD4C59AB47B0244FB12DE4422 # gpg: Good signature from "Taylor Simpson (Rock on) <tsimpson@quicinc.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 3635 C788 CE62 B91F D4C5 9AB4 7B02 44FB 12DE 4422 * tag 'pull-hex-20230526' of https://github.com/quic/qemu: Hexagon (target/hexagon) Change Hexagon maintainer Hexagon: fix outdated `hex_new_*` comments target/hexagon/*.py: clean up used 'toss' and 'numregs' vars Hexagon (target/hexagon) Fix assignment to tmp registers Hexagon (tests/tcg/hexagon) Clean up Hexagon check-tcg tests Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26Hexagon: fix outdated `hex_new_*` commentsMatheus Tavares Bernardino2-15/+13
Some code comments refer to hex_new_value and hex_new_pred_value, which have been transferred to DisasContext and, in the case of hex_new_value, should now be accessed through get_result_gpr(). In order to fix this outdated comments and also avoid having to tweak them whenever we make a variable name change in the future, let's replace them with pseudocode. Suggested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <8e1689e28dd7b1318369b55127cf47b82ab75921.1684939078.git.quic_mathbern@quicinc.com>
2023-05-26target/hexagon/*.py: clean up used 'toss' and 'numregs' varsMatheus Tavares Bernardino7-70/+70
Many Hexagon python scripts call hex_common.get_tagregs(), but only one call site use the full reg structure given by this function. To make the code cleaner, let's make get_tagregs() filter out the unused fields (i.e. 'toss' and 'numregs'), properly removed the unused variables at the call sites. The hex_common.bad_register() function is also adjusted to work exclusively with 'regtype' and 'regid' args. For the single call site that does use toss/numregs, we provide an optional parameter to get_tagregs() which will restore the old full behavior. Suggested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <3ffd4ccb972879f57f499705c624e8eaba7f8b52.1684939078.git.quic_mathbern@quicinc.com>
2023-05-26Hexagon (target/hexagon) Fix assignment to tmp registersMarco Liebel1-4/+4
The order in which instructions are generated by gen_insn() influences assignment to tmp registers. During generation, tmp instructions (e.g. generate_V6_vassign_tmp) use vreg_src_off() to determine what kind of register to use as source. If some instruction (e.g. generate_V6_vmpyowh_64_acc) uses a tmp register but is generated prior to the corresponding tmp instruction, the vregs_updated_tmp bit map isn't updated in time. Exmple: { v14.tmp = v16; v25 = v14 } This works properly because generate_V6_vassign_tmp is generated before generate_V6_vassign and the bit map is updated. { v15:14.tmp = vcombine(v21, v16); v25:24 += vmpyo(v18.w,v14.h) } This does not work properly because vmpyo is generated before vcombine and therefore the bit map does not yet know that there's a tmp register. The parentheses in the decoding function were in the wrong place. Moving them to the correct location makes shuffling of .tmp vector registers work as expected. Signed-off-by: Marco Liebel <quic_mliebel@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20230522174708.464197-1-quic_mliebel@quicinc.com>
2023-05-26target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system ↵Song Gao1-13/+26
coredump The vinsgr2vr/vpickve2gr instructions need use get_src/get_dst to get gpr registers value, not cpu_gpr[]. The $zero register does not have cpu_gpr[0] allocated. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1662 Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230525120005.2223413-1-gaosong@loongson.cn>
2023-05-26target/loongarch: Fix LD/ST{LE/GT} instructions get wrong CSR_ERA and CSR_BADVSong Gao2-3/+5
1.helper_asrtle_d/helper_asrtgt_d need use GETPC() to get PC; 2 LD/ST{LE/GT} need set CSR_BADV = gpr[rj]; 3 ASRTLE.D/ASRTGT.D also write CSR_BADV, but this value is random and has no reference value. Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230515130042.2719712-1-gaosong@loongson.cn>
2023-05-25Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson1-0/+10
* hot-unplug fixes for ioport * purge qatomic_mb_read/set from monitor * build system fixes * OHCI fix from gitlab * provide EPYC-Rome CPU model not susceptible to XSAVES erratum # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRvGpEUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOa/Af/WS5/tmIlEYgH7UOPERQXNqf7+Jwj # bA2wgqv3ZoQwcgp5f4EVjfA8ABfpGxLZy6xIdUSbWANb8lDJNuh/nPd/em3rWUAU # LnJGGdo1vF31gfsVQnlzb7hJi3ur+e2f8JqkRVskDCk3a7YY44OCN42JdKWLrN9u # CFf2zYqxMqXHjrYrY0Kx2oTkfGDZrfwUlx0vM4dHb8IEoxaplfDd8lJXQzjO4htr # 3nPBPjQ+h08EeC7mObH4XoJE0omzovR10GkBo8K4q952xGOQ041Y/2YY7JwLfx0D # na7IanVo+ZAmvTJZoJFSBwNnXkTMHvDH5+Hc45NSTsDBtz0YJhRxPw/z/A== # =A5Lp # -----END PGP SIGNATURE----- # gpg: Signature made Thu 25 May 2023 01:21:37 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: monitor: do not use mb_read/mb_set monitor: extract request dequeuing to a new function monitor: introduce qmp_dispatcher_co_wake monitor: cleanup fetching of QMP requests monitor: cleanup detection of qmp_dispatcher_co shutting down monitor: do not use mb_read/mb_set for suspend_cnt monitor: add more *_locked() functions monitor: allow calling monitor_resume under mon_lock monitor: use QEMU_LOCK_GUARD a bit more softmmu/ioport.c: make MemoryRegionPortioList owner of portio_list MemoryRegions softmmu/ioport.c: QOMify MemoryRegionPortioList softmmu/ioport.c: allocate MemoryRegionPortioList ports on the heap usb/ohci: Set pad to 0 after frame update meson: move -no-pie from linker to compiler meson: fix rule for qemu-ga installer meson.build: Fix glib -Wno-unused-function workaround target/i386: EPYC-Rome model without XSAVES Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-25target/i386: EPYC-Rome model without XSAVESMaksim Davydov1-0/+10
Based on the kernel commit "b0563468ee x86/CPU/AMD: Disable XSAVES on AMD family 0x17", host system with EPYC-Rome can clear XSAVES capability bit. In another words, EPYC-Rome host without XSAVES can occur. Thus, we need an EPYC-Rome cpu model (without this feature) that matches the solution of fixing this erratum Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> Message-Id: <20230524213748.8918-1-davydov-max@yandex-team.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-23tcg: Remove DEBUG_DISASRichard Henderson2-4/+0
This had been set since the beginning, is never undefined, and it would seem to be harmful to debugging to do so. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23qemu/atomic128: Split atomic16_readRichard Henderson1-1/+1
Create both atomic16_read_ro and atomic16_read_rw. Previously we pretended that we had atomic16_read in system mode, because we "know" that all ram is always writable to the host. Now, expose read-only and read-write versions all of the time. For aarch64, do not fall back to __atomic_read_16 even if supported by the compiler, to work around a clang bug. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23target/s390x: Always use cpu_atomic_cmpxchgl_be_mmu in do_csstRichard Henderson1-7/+1
Eliminate the CONFIG_USER_ONLY specialization. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23target/s390x: Use cpu_{ld,st}*_mmu in do_csstRichard Henderson1-39/+27
Use cpu_ld16_mmu and cpu_st16_mmu to eliminate the special case, and change all of the *_data_ra functions to match. Note that we check the alignment of both compare and store pointers at the top of the function, so MO_ALIGN* may be safely removed from the individual memory operations. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23accel/tcg: Unify cpu_{ld,st}*_{be,le}_mmuRichard Henderson2-17/+5
With the current structure of cputlb.c, there is no difference between the little-endian and big-endian entry points, aside from the assert. Unify the pairs of functions. The only use of the functions with explicit endianness was in target/sparc64, and that was only to satisfy the assert: the correct endianness is already built into memop. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23target/s390x: Use tcg_gen_qemu_{ld,st}_i128 for LPQ, STPQRichard Henderson5-91/+9
No need to roll our own, as this is now provided by tcg. This was the last use of retxl, so remove that too. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23target/ppc: Use tcg_gen_qemu_{ld,st}_i128 for LQARX, LQ, STQRichard Henderson5-132/+11
No need to roll our own, as this is now provided by tcg. This was the last use of retxl, so remove that too. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-19Revert "arm/kvm: add support for MTE"Peter Maydell5-68/+4
This reverts commit b320e21c48ce64853904bea6631c0158cc2ef227, which accidentally broke TCG, because it made the TCG -cpu max report the presence of MTE to the guest even if the board hadn't enabled MTE by wiring up the tag RAM. This meant that if the guest then tried to use MTE QEMU would segfault accessing the non-existent tag RAM: ==346473==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address (pc 0x55f328952a4a bp 0x00000213a400 sp 0x7f7871859b80 T346476) ==346473==The signal is caused by a READ memory access. ==346473==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x55f328952a4a in address_space_to_flatview /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/exec/memory.h:1108:12 #1 0x55f328952a4a in address_space_translate /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/exec/memory.h:2797:31 #2 0x55f328952a4a in allocation_tag_mem /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/../../target/arm/tcg/mte_helper.c:176:10 #3 0x55f32895366c in helper_stgm /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/../../target/arm/tcg/mte_helper.c:461:15 #4 0x7f782431a293 (<unknown module>) It's also not clear that the KVM logic is correct either: MTE defaults to on there, rather than being only on if the board wants it on. Revert the whole commit for now so we can sort out the issues. (We didn't catch this in CI because we have no test cases in avocado that use guests with MTE support.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230519145808.348701-1-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-18Merge tag 'pull-hex-20230518-1' of https://github.com/quic/qemu into stagingRichard Henderson35-421/+1646
Hexagon update # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEENjXHiM5iuR/UxZq0ewJE+xLeRCIFAmRmgQgACgkQewJE+xLe # RCJLtAf8C/0kQRa4mjnbsztXuFyca53UxAv3BSBEDla4ZcMfFBoVJsGB3OP7IPXd # KBQpkLyJAVye9idex5xqdp9nIfoGKDTsc6YtCfGujZ17cDpzLRDpHdUTex8PcZYK # wpfM3hoVJsYRBMsojZ4OaxatjFQ+FWzrIH6FcgH086Q8TH4w9dZLNEJzHC4lOj0s # 7qOuw2tgm+vOVlzsk/fv6/YD/BTeZTON3jgTPvAnvdRLb/482UpM9JkJ8E4rbte3 # Ss5PUK8QTQHU0yamspGy/PfsYxiptM+jIWGd836fAGzwF12Ug27mSc1enndRtQVW # pQTdnOnWuuRzOwEpd7x3xh9upACm4g== # =1CyJ # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 May 2023 12:48:24 PM PDT # gpg: using RSA key 3635C788CE62B91FD4C59AB47B0244FB12DE4422 # gpg: Good signature from "Taylor Simpson (Rock on) <tsimpson@quicinc.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 3635 C788 CE62 B91F D4C5 9AB4 7B02 44FB 12DE 4422 * tag 'pull-hex-20230518-1' of https://github.com/quic/qemu: (44 commits) Hexagon (linux-user/hexagon): handle breakpoints Hexagon (gdbstub): add HVX support Hexagon (gdbstub): fix p3:0 read and write via stub Hexagon: add core gdbstub xml data for LLDB gdbstub: add test for untimely stop-reply packets gdbstub: only send stop-reply packets when allowed to Remove test_vshuff from hvx_misc tests Hexagon (decode): look for pkts with multiple insns at the same slot Hexagon (iclass): update J4_hintjumpr slot constraints Hexagon: append eflags to unknown cpu model string Hexagon: list available CPUs with `-cpu help` Hexagon (target/hexagon/*.py): raise exception on reg parsing error target/hexagon: fix = vs. == mishap Hexagon (target/hexagon) Additional instructions handled by idef-parser Hexagon (target/hexagon) Move items to DisasContext Hexagon (target/hexagon) Move pkt_has_store_s1 to DisasContext Hexagon (target/hexagon) Move pred_written to DisasContext Hexagon (target/hexagon) Move new_pred_value to DisasContext Hexagon (target/hexagon) Move new_value to DisasContext Hexagon (target/hexagon) Make special new_value for USR ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-18Hexagon (gdbstub): add HVX supportTaylor Simpson3-0/+76
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Co-authored-by: Brian Cain <bcain@quicinc.com> Signed-off-by: Brian Cain <bcain@quicinc.com> Co-authored-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <17cb32f34d469f705c3cc066a3583935352ee048.1683214375.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon (gdbstub): fix p3:0 read and write via stubBrian Cain1-0/+16
Signed-off-by: Brian Cain <bcain@quicinc.com> Co-authored-by: Sid Manning <sidneym@quicinc.com> Signed-off-by: Sid Manning <sidneym@quicinc.com> Co-authored-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <32e7de567cdae184a6781644454bbb19916c955b.1683214375.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon: add core gdbstub xml data for LLDBMatheus Tavares Bernardino1-1/+2
Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <d25a3a79334d81f0e1ecfb438b6ee82585d02dc4.1683214375.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon (decode): look for pkts with multiple insns at the same slotMatheus Tavares Bernardino1-3/+27
Each slot in a packet can be assigned to at most one instruction. Although the assembler generally ought to enforce this rule, we better be safe than sorry and also do some check to properly throw an "invalid packet" exception on wrong slot assignments. This should also make it easier to debug possible future errors caused by missing updates to `find_iclass_slots()` rules in target/hexagon/iclass.c. Co-authored-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <f8b829443523568823d062adf8bf6659bc6d4a3f.1683552984.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon (iclass): update J4_hintjumpr slot constraintsMatheus Tavares Bernardino1-2/+4
The Hexagon PRM says that "The assembler automatically encodes instructions in the packet in the proper order. In the binary encoding of a packet, the instructions must be ordered from Slot 3 down to Slot 0." Prior to the architecture version v73, the slot constraints from instruction "hintjr" only allowed it to be executed at slot 2. With that in mind, consider the packet: { hintjr(r0) nop nop if (!p0) memd(r1+#0) = r1:0 } To satisfy the ordering rule quoted from the PRM, the assembler would, thus, move one of the nops to the first position, so that it can be assigned to slot 3 and the subsequent hintjr to slot 2. However, since v73, hintjr can be executed at either slot 2 or 3. So there is no need to reorder that packet and the assembler will encode it as is. When QEMU tries to execute it, however, we end up hitting a "misaliged store" exception because both the store and the hintjr will be assigned to store 0, and some functions like `slot_is_predicated()` expect the decode machinery to assign only one instruction per slot. In particular, the mentioned function will traverse the packet until it finds the first instruction at the desired slot which, for slot 0, will be hintjr. Since hintjr is not predicated, the result is that we try to execute the store regardless of the predicate. And because the predicate is false, we had not previously loaded hex_store_addr[0] or hex_store_width[0]. As a result, the store will decide de width based on trash memory, causing it to be misaligned. Update the slot constraints for hintjr so that QEMU can properly handle such encodings. Note: to avoid similar-but-not-identical issues in the future, we should look for multiple instructions at the same slot during decoding time and throw an invalid packet exception. That will be done in the subsequent commit. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <0fcd8293642c6324119fbbab44741164bcbd04fb.1673616964.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon: list available CPUs with `-cpu help`Matheus Tavares Bernardino2-0/+23
Currently, qemu-hexagon only models the v67 cpu. Nonetheless if we try to get this information with `-cpu help`, qemu just exists with an error code and no output. Let's correct that. The code is basically a copy from target/alpha/cpu.h, but we strip the "-hexagon-cpu" suffix before printing. This is to avoid confusing situations like the following: $ qemu-hexagon -cpu help Available CPUs: v67-hexagon-cpu $ qemu-hexagon -cpu v67-hexagon-cpu ./prog qemu-hexagon: unable to find CPU model 'v67-hexagon-cpu' Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <b946e17c7e17eed9095700b54c5ead36e5d55dfa.1683225804.git.quic_mathbern@quicinc.com>
2023-05-18Hexagon (target/hexagon/*.py): raise exception on reg parsing errorMatheus Tavares Bernardino6-63/+66
Currently, the python scripts used for the hexagon building will not abort the compilation when there is an error parsing a register. Let's make the compilation properly fail in such cases by rasing an exception instead of just printing a warning message, which might get lost in the output. This patch was generated with: git grep -l "Bad register" *hexagon* | \ xargs sed -i "" -e 's/print("Bad register parse: "[, ]*\([^)]*\))/hex_common.bad_register(\1)/g' Plus the bad_register() helper added to hex_common.py. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <1f5dbd92f68fdd89e2647e4ba527a2c32cf0f070.1683217043.git.quic_mathbern@quicinc.com>
2023-05-18target/hexagon: fix = vs. == mishapPaolo Bonzini2-3/+3
**** Changes in v2 **** Fix yyassert's for sign and zero extends Coverity reports a parameter that is "set but never used". This is caused by an assignment operator being used instead of equality. Co-authored-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Tested-by: Anton Johansson <anjo@rev.ng> Message-Id: <20230428204411.1400931-1-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Additional instructions handled by idef-parserTaylor Simpson5-41/+71
**** Changes in v3 **** Fix bugs exposed by dpmpyss_rnd_s0 instruction Set correct size/signedness for constants Test cases added to tests/tcg/hexagon/misc.c **** Changes in v2 **** Fix bug in imm_print identified in clang build Currently, idef-parser skips all floating point instructions. However, there are some floating point instructions that can be handled. The following instructions are now parsed F2_sfimm_p F2_sfimm_n F2_dfimm_p F2_dfimm_n F2_dfmpyll F2_dfmpylh To make these instructions work, we fix some bugs in parser-helpers.c gen_rvalue_extend gen_cast_op imm_print lexer properly sets size/signedness of constants Test cases added to tests/tcg/hexagon/fpstuff.c Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Anton Johansson <anjo@rev.ng> Message-Id: <20230501203125.4025991-1-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Move items to DisasContextTaylor Simpson8-31/+21
The following items in the CPUHexagonState are only used for bookkeeping within the translation of a packet. With recent changes that eliminate the need to free TCGv variables, these make more sense to be transient and kept in DisasContext. The following items are moved dczero_addr branch_taken this_PC Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-22-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Move pkt_has_store_s1 to DisasContextTaylor Simpson11-40/+51
The pkt_has_store_s1 field is only used for bookkeeping helpers with a load. With recent changes that eliminate the need to free TCGv variables, it makes more sense to make this transient. These helpers already take the instruction slot as an argument. We combine the slot and pkt_has_store_s1 into a single argument called slotval. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-21-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Move pred_written to DisasContextTaylor Simpson6-12/+10
The pred_written variable in the CPUHexagonState is only used for bookkeeping within the translation of a packet. With recent changes that eliminate the need to free TCGv variables, these make more sense to be transient and kept in DisasContext. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-20-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Move new_pred_value to DisasContextTaylor Simpson8-24/+23
The new_pred_value array in the CPUHexagonState is only used for bookkeeping within the translation of a packet. With recent changes that eliminate the need to free TCGv variables, these make more sense to be transient and kept in DisasContext. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-19-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Move new_value to DisasContextTaylor Simpson4-14/+9
The new_value array in the CPUHexagonState is only used for bookkeeping within the translation of a packet. With recent changes that eliminate the need to free TCGv variables, these make more sense to be transient and kept in DisasContext. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-18-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Make special new_value for USRTaylor Simpson8-12/+27
Precursor to moving new_value from the global state to DisasContext USR will need to stay in the global state because some helpers will set it's value Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-17-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Add overrides for disabled idef-parser insnsTaylor Simpson2-0/+117
The following have overrides S2_insert S2_insert_rp S2_asr_r_svw_trun A2_swiz These instructions have semantics that write to the destination before all the operand reads have been completed. Therefore, the idef-parser versions were disabled with the short-circuit patch. Test cases added to tests/tcg/hexagon/read_write_overlap.c Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-16-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Short-circuit more HVX single instruction packetsTaylor Simpson4-2/+44
The generated helpers for HVX use pass-by-reference, so they can't short-circuit when the reads/writes overlap. The instructions with overrides are OK because they use tcg_gen_gvec_*. We add a flag has_hvx_helper to DisasContext and extend gen_analyze_funcs to set the flag when the instruction is an HVX instruction with a generated helper. We add an override for V6_vcombine so that it can be short-circuited along with a test case in tests/tcg/hexagon/hvx_misc.c Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-15-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Short-circuit packet HVX writesTaylor Simpson2-2/+50
In certain cases, we can avoid the overhead of writing to future_VRegs and write directly to VRegs. We consider HVX reads/writes when computing ctx->need_commit. Then, we can early-exit from gen_commit_hvx. Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-14-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Short-circuit packet predicate writesTaylor Simpson3-6/+24
In certain cases, we can avoid the overhead of writing to hex_new_pred_value and write directly to hex_pred. We consider predicate reads/writes when computing ctx->need_commit. The get_result_pred() function uses this field to decide between hex_new_pred_value and hex_pred. Then, we can early-exit from gen_pred_writes. Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-13-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Short-circuit packet register writesTaylor Simpson16-30/+128
In certain cases, we can avoid the overhead of writing to hex_new_value and write directly to hex_gpr. We add need_commit field to DisasContext indicating if the end-of-packet commit is needed. If it is not needed, get_result_gpr() and get_result_gpr_pair() can return hex_gpr. We pass the ctx->need_commit to helpers when needed. Finally, we can early-exit from gen_reg_writes during packet commit. There are a few instructions whose semantics write to the result before reading all the inputs. Therefore, the idef-parser generated code is incompatible with short-circuit. We tell idef-parser to skip them. For debugging purposes, we add a cpu property to turn off short-circuit. When the short-circuit property is false, we skip the analysis and force the end-of-packet commit. Here's a simple example of the TCG generated for 0x004000b4: 0x7800c020 { R0 = #0x1 } BEFORE: ---- 004000b4 movi_i32 new_r0,$0x1 mov_i32 r0,new_r0 AFTER: ---- 004000b4 movi_i32 r0,$0x1 This patch reintroduces a use of check_for_attrib, so we remove the G_GNUC_UNUSED added earlier in this series. Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20230427230012.3800327-12-tsimpson@quicinc.com>
2023-05-18Hexagon (target/hexagon) Mark registers as read during packet analysisTaylor Simpson5-15/+97
Have gen_analyze_funcs mark the registers that are read by the instruction. We also mark the implicit reads using instruction attributes. Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230427230012.3800327-11-tsimpson@quicinc.com>
generated by cgit v1.1 at 2024-09-04 07:15:30 +0000