aboutsummaryrefslogtreecommitdiff
path: root/target/ppc/mmu_helper.c
AgeCommit message (Collapse)Author
2020-05-15target: Remove unnecessary CPU() castPhilippe Mathieu-Daudé
The CPU() macro is defined as: #define CPU(obj) ((CPUState *)(obj)) which expands to: ((CPUState *)object_dynamic_cast_assert((Object *)(obj), (name), __FILE__, __LINE__, __func__)) This assertion can only fail when @obj points to something other than its stated type, i.e. when we're in undefined behavior country. Remove the unnecessary CPU() casts when we already know the pointer is of CPUState type. Patch created mechanically using spatch with this script: @@ typedef CPUState; CPUState *s; @@ - CPU(s) + s Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-2-f4bug@amsat.org>
2019-08-21target/ppc: Rewrite a fall through commentPhilippe Mathieu-Daudé
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: target/ppc/mmu_helper.c: In function ‘dump_mmu’: target/ppc/mmu_helper.c:1349:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 1349 | if (ppc64_v3_radix(env_archcpu(env))) { | ^ target/ppc/mmu_helper.c:1356:5: note: here 1356 | default: | ^~~~~~~ cc1: all warnings being treated as errors Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190719131425.10835-6-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-16Include qemu/main-loop.h lessMarkus Armbruster
In my "build everything" tree, changing qemu/main-loop.h triggers a recompile of some 5600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). It includes block/aio.h, which in turn includes qemu/event_notifier.h, qemu/notify.h, qemu/processor.h, qemu/qsp.h, qemu/queue.h, qemu/thread-posix.h, qemu/thread.h, qemu/timer.h, and a few more. Include qemu/main-loop.h only where it's needed. Touching it now recompiles only some 1700 objects. For block/aio.h and qemu/event_notifier.h, these numbers drop from 5600 to 2800. For the others, they shrink only slightly. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190812052359.30071-21-armbru@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-06-10target/ppc: Use env_cpu, env_archcpuRichard Henderson
Cleanup in the boilerplate that each target must define. Replace ppc_env_get_cpu with env_archcpu. The combination CPU(ppc_env_get_cpu) should have used ENV_GET_CPU to begin; use env_cpu now. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-06-10cpu: Replace ENV_GET_CPU with env_cpuRichard Henderson
Now that we have both ArchCPU and CPUArchState, we can define this generically instead of via macro in each target's cpu.h. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-05-10tcg: Use CPUClass::tlb_fill in cputlb.cRichard Henderson
We can now use the CPUClass hook instead of a named function. Create a static tlb_fill function to avoid other changes within cputlb.c. This also isolates the asserts within. Remove the named tlb_fill function from all of the targets. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-05-10target/ppc: Convert to CPUClass::tlb_fillRichard Henderson
Cc: qemu-ppc@nongnu.org Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-04-26target/ppc: improve performance of large BAT invalidationsArtyom Tarasenko
Performing a complete flush is ~ 100 times faster than flushing 256MiB of 4KiB pages. Set a limit of 1024 pages and perform a complete flush afterwards. This patch significantly speeds up AIX 5.1 and NetBSD-ofppc. Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <1555103178-21894-4-git-send-email-atar4qemu@gmail.com> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-04-26target/ppc: Style fixes for mmu_helper.cDavid Gibson
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2019-04-18target: Clean up how the dump_mmu() printMarkus Armbruster
The various dump_mmu() take an fprintf()-like callback and a FILE * to pass to it, and so do their helper functions. Passing around callback and argument is rather tiresome. Most dump_mmu() are called only by the target's hmp_info_tlb(). These all pass monitor_printf() cast to fprintf_function and the current monitor cast to FILE *. SPARC's dump_mmu() gets also called from target/sparc/ldst_helper.c a few times #ifdef DEBUG_MMU. These calls pass fprintf() and stdout. The type-punning is technically undefined behaviour, but works in practice. Clean up: drop the callback, and call qemu_printf() instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190417191805.28198-11-armbru@redhat.com>
2019-02-26target/ppc/mmu: Use LPCR:HR to chose radix vs. hash translationBenjamin Herrenschmidt
Now that LPCR:HR is set properly for SPAPR, use it for deciding the translation type, which also works for bare metal Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190215170029.15641-3-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-02-17target/ppc: Remove some #if 0'ed codeBenjamin Herrenschmidt
Some debug stuff we don't need to keep there Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190128094625.4428-7-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-11-08target/ppc: add external PID supportRoman Kapl
External PID is a mechanism present on BookE 2.06 that enables application to store/load data from different address spaces. There are special version of some instructions, which operate on alternate address space, which is specified in the EPLC/EPSC regiser. This implementation uses two additional MMU modes (mmu_idx) to provide the address space for the load and store instructions. The QEMU TLB fill code was modified to recognize these MMU modes and use the values in EPLC/EPSC to find the proper entry in he PPC TLB. These two QEMU TLBs are also flushed on each write to EPLC/EPSC. Following instructions are implemented: dcbfep dcbstep dcbtep dcbtstep dcbzep dcbzlep icbiep lbepx ldepx lfdepx lhepx lwepx stbepx stdepx stfdepx sthepx stwepx. Following vector instructions are not: evlddepx evstddepx lvepx lvepxl stvepx stvepxl. Signed-off-by: Roman Kapl <rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-08-28ppc: Remove deprecated ppcemb targetThomas Huth
There is no known available OS for ppc around anymore that uses page sizes below 4k, so it does not make much sense that we keep wasting our time on building and testing the ppcemb-softmmu target. It has been deprecated since two releases, and nobody complained, so let's remove this now. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-07-02hw/ppc: Use the IEC binary prefix definitionsPhilippe Mathieu-Daudé
It eases code review, unit is explicit. Patch generated using: $ git grep -E '(1024|2048|4096|8192|(<<|>>).?(10|20|30))' hw/ include/hw/ and modified manually. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20180625124238.25339-33-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-05-04target/ppc: add basic support for PTCR on POWER9Cédric Le Goater
The Partition Table Control Register (PTCR) is a hypervisor privileged SPR. It contains the host real address of the Partition Table and its size. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-04-27target/ppc: Get rid of POWERPC_MMU_VER() macrosDavid Gibson
These macros were introduced to deal with the fact that the mmu_model field has bit flags mixed in with what's otherwise an enum of various mmu types. We've now eliminated all those flags except for one, and that one - POWERPC_MMU_64 - is already included/compared in the MMU_VER macros. So, we can get rid of those macros and just directly compare mmu_model values in the places it was used. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-02-09Include qapi/error.h exactly where neededMarkus Armbruster
This cleanup makes the number of objects depending on qapi/error.h drop from 1910 (out of 4743) to 1612 in my "build everything" tree. While there, separate #include from file comment with a blank line, and drop a useless comment on why qemu/osdep.h is included first. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180201111846.21846-5-armbru@redhat.com> [Semantic conflict with commit 34e304e975 resolved, OSX breakage fixed]
2018-01-25accel/tcg: add size paremeter in tlb_fill()Laurent Vivier
The MC68040 MMU provides the size of the access that triggers the page fault. This size is set in the Special Status Word which is written in the stack frame of the access fault exception. So we need the size in m68k_cpu_unassigned_access() and m68k_cpu_handle_mmu_fault(). To be able to do that, this patch modifies the prototype of handle_mmu_fault handler, tlb_fill() and probe_write(). do_unassigned_access() already includes a size parameter. This patch also updates handle_mmu_fault handlers and tlb_fill() of all targets (only parameter, no code change). Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20180118193846.24953-2-laurent@vivier.eu>
2018-01-17target-ppc: Fix booke206 tlbwe TLB instructionLuc MICHEL
When overwritting a valid TLB entry with a new one, the previous page were not flushed in QEMU TLB, leading to incoherent mapping. This commit fixes this. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-09-08booke206: fix tlbnps for fixed size TLBKONRAD Frederic
Some OS don't populate the TSIZE field when using a fixed size TLB which result in a 1KB TLB. When the TLB is a fixed size TLB the TSIZE field should be ignored. Fix this wrong behavior with MAV 2.0. Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-08-09booke206: fix MAS update on tlb missKONRAD Frederic
When a tlb instruction miss happen, rw is set to 0 at the bottom of cpu_ppc_handle_mmu_fault which cause the MAS update function to miss the SAS and TS bit in MAS6, MAS1 in booke206_update_mas_tlb_miss. Just calling booke206_update_mas_tlb_miss with rw = 2 solve the issue. Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-07-11target/ppc: Add debug function for radix mmu translationSuraj Jitindar Singh
In target/ppc/mmu-hash64.c there already exists the function ppc_hash64_get_phys_page_debug() to get the physical (real) address for a given effective address in hash mode. Implement the function ppc_radix64_get_phys_page_debug() to allow a real address to be obtained for a given effective address in radix mode. This is used when a debugger is attached to qemu. Previously we just had a comment saying this is unimplemented which then fell through to the default case and caused an abort due to unrecognised mmu model as the default had no case for the V3 mmu, which was misleading at best. We reuse ppc_radix64_walk_tree() which is used by the radix fault handler since the process of walking the radix tree is identical. Reported-by: Balbir Singh <bsingharora@gmail.com> Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-03spapr: Small cleanup of PPC MMU enumsSam Bobroff
The PPC MMU types are sometimes treated as if they were a bit field and sometime as if they were an enum which causes maintenance problems: flipping bits in the MMU type (which is done on both the 1TB segment and 64K segment bits) currently produces new MMU type values that are not handled in every "switch" on it, sometimes causing an abort(). This patch provides some macros that can be used to filter out the "bit field-like" bits so that the remainder of the value can be switched on, like an enum. This allows removal of all of the "degraded" types from the list and should ease maintenance. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-03target/ppc/POWER9: Add POWER9 mmu fault handlerSuraj Jitindar Singh
Add a new mmu fault handler for the POWER9 cpu and add it as the handler for the POWER9 cpu definition. This handler checks if the guest is radix or hash based on the value in the partition table entry and calls the correct fault handler accordingly. The hash fault handling code has also been updated to check if the partition is using segment tables. Currently only legacy hash (no segment tables) is supported. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: Correct SDR1 maskingDavid Gibson
SDR_64_HTABORG, which indicates the bits of the SDR1 register to use for the base of a 64-bit machine's hashed page table (HPT) isn't correct. It includes the top 46 bits of the register, but in fact the top 4 bits must be zero (according to the ISA v2.07). No actual implementation has supported close to 2^60 bytes of physical address space, so it's kind of irrelevant, but we might as well correct this. In addition, although we checked for bad size values in SDR1, we never reported an error if entirely invalid bits were set there. Add this check to ppc_store_sdr1(). Reported-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: Remove the function ppc_hash64_set_sdr1()Suraj Jitindar Singh
The function ppc_hash64_set_sdr1 basically checked the htabsize and set an error if it was too big, otherwise it just stored the value in SPR_SDR1. Given that the only function which calls ppc_hash64_set_sdr1() is ppc_store_sdr1(), why not handle the checking in ppc_store_sdr1() to avoid the extra function call. Note that ppc_store_sdr1() already stores the value in SPR_SDR1 anyway, so we were doing it twice. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> [dwg: Remove unnecessary error temporary] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: Manage external HPT via virtual hypervisorDavid Gibson
The pseries machine type implements the behaviour of a PAPR compliant hypervisor, without actually executing such a hypervisor on the virtual CPU. To do this we need some hooks in the CPU code to make hypervisor facilities get redirected to the machine instead of emulated internally. For hypercalls this is managed through the cpu->vhyp field, which points to a QOM interface with a method implementing the hypercall. For the hashed page table (HPT) - also a hypervisor resource - we use an older hack. CPUPPCState has an 'external_htab' field which when non-NULL indicates that the HPT is stored in qemu memory, rather than within the guest's address space. For consistency - and to make some future extensions easier - this merges the external HPT mechanism into the vhyp mechanism. Methods are added to vhyp for the basic operations the core hash MMU code needs: map_hptes() and unmap_hptes() for reading the HPT, store_hpte() for updating it and hpt_mask() to retrieve its size. To match this, the pseries machine now sets these vhyp fields in its existing vhyp class, rather than reaching into the cpu object to set the external_htab field. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
2017-03-01target/ppc: Eliminate htab_base and htab_mask variablesDavid Gibson
CPUPPCState includes fields htab_base and htab_mask which store the base address (GPA) and size (as a mask) of the guest's hashed page table (HPT). These are set when the SDR1 register is updated. Keeping these in sync with the SDR1 is actually a little bit fiddly, and probably not useful for performance, since keeping them expands the size of CPUPPCState. It also makes some upcoming changes harder to implement. This patch removes these fields, in favour of calculating them directly from the SDR1 contents when necessary. This does make a change to the behaviour of attempting to write a bad value (invalid HPT size) to the SDR1 with an mtspr instruction. Previously, the bad value would be stored in SDR1 and could be retrieved with a later mfspr, but the HPT size as used by the softmmu would be, clamped to the allowed values. Now, writing a bad value is treated as a no-op. An error message is printed in both new and old versions. I'm not sure which behaviour, if either, matches real hardware. I don't think it matters that much, since it's pretty clear that if an OS writes a bad value to SDR1, it's not going to boot. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2017-02-22target-ppc: fix Book-E TLB matchingAlex Zuepke
The Book-E TLB matching process should bail out early when a TLB entry matches, but the access permissions are wrong. The CPU will then raise a DSI error instead of a Data TLB error, as described for TLB matching in Freescale and IBM documents. Signed-off-by: Alex Zuepke <azu@sysgo.de> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-02-22target/ppc/POWER9: Add ISAv3.00 MMU definitionSuraj Jitindar Singh
POWER9 processors implement the mmu as defined in version 3.00 of the ISA. Add a definition for this mmu model and set the POWER9 cpu model to use this mmu model. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-13cputlb: drop flush_global flag from tlb_flushAlex Bennée
We have never has the concept of global TLB entries which would avoid the flush so we never actually use this flag. Drop it and make clear that tlb_flush is the sledge-hammer it has always been. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> [DG: ppc portions] Acked-by: David Gibson <david@gibson.dropbear.id.au>
2016-12-20Move target-* CPU file into a target/ folderThomas Huth
We've currently got 18 architectures in QEMU, and thus 18 target-xxx folders in the root folder of the QEMU source tree. More architectures (e.g. RISC-V, AVR) are likely to be included soon, too, so the main folder of the QEMU sources slowly gets quite overcrowded with the target-xxx folders. To disburden the main folder a little bit, let's move the target-xxx folders into a dedicated target/ folder, so that target-xxx/ simply becomes target/xxx/ instead. Acked-by: Laurent Vivier <laurent@vivier.eu> [m68k part] Acked-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> [tricore part] Acked-by: Michael Walle <michael@walle.cc> [lm32 part] Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> [s390x part] Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> [s390x part] Acked-by: Eduardo Habkost <ehabkost@redhat.com> [i386 part] Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> [sparc part] Acked-by: Richard Henderson <rth@twiddle.net> [alpha part] Acked-by: Max Filippov <jcmvbkbc@gmail.com> [xtensa part] Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [ppc part] Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> [cris&microblaze part] Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn> [unicore32 part] Signed-off-by: Thomas Huth <thuth@redhat.com>