SH4 manual say that if a floating point instruction is executed while
FD bit in the status register is 1, an exception should be raised. QEMU
presently does not do that, so the kernel does not initialize FP state
for any thread, nor does it save/restore FP state. The most apparent
consequence is that while recent gcc/libc expect double-precision mode
to be set by kernel, they run in single-precision mode, and all FP code
produces wrong values.
This patch fixes this. It also fixes a couple of places where PC was
not updated before handling an exception, although both those places
deal with invalid instruction and don't lead to any user-visible bugs.
(Vladimir Prus)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5937 c046a42c-6fe2-441c-8c8c-71466251a162
Main purpose of this is to delete
*physical = address & 0x1fffffff;
at target-sh4/helper.c:449, using new mmio rule introduced by #5849
This masking is a nice trick to realize P4/A7 duality of SH registers.
But, IMHO, it is logically wrong.
Most of SH4 cpu control registers in P4 area(0xfc000000...0xffffffff) have
one more address called A7 which is usually P4 address with upper 3bits masked.
This is an address only appears in TLB's physical address part.
Current code use trick writing drivers as if they are really in A7
(that's why you see many *_A7 in hw/sh*.c), and using translation P4 to A7.
Signed-off-by: Takashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5935 c046a42c-6fe2-441c-8c8c-71466251a162
All archs use the same cpu_loop_exit, so move the prototype in a common
header. i386 was carrying a __hidden attribute, but that was empty for
this arch anyway.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5820 c046a42c-6fe2-441c-8c8c-71466251a162
This switches cpu_break/watchpoint_* to TAILQ wrappers, simplifying the
code and also fixing a use after release issue in
cpu_break/watchpoint_remove_all.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5799 c046a42c-6fe2-441c-8c8c-71466251a162
When loading/storing a register pair, the even-numbered register
always maps to the low 32 bits of memory independently of target
endian configuration.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5773 c046a42c-6fe2-441c-8c8c-71466251a162
Based on a patch from Vladimir Prus and comments from Shin-ichiro KAWASAKI.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5770 c046a42c-6fe2-441c-8c8c-71466251a162
fldi0/fldi1 should be executed as a nop if FPSCR.FR is set instead of
generating an exception. Reported by Laurent Desnogues.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5759 c046a42c-6fe2-441c-8c8c-71466251a162
This patch prepares the QEMU cpu_watchpoint/breakpoint API to allow the
succeeding enhancements this series comes with.
First of all, it overcomes MAX_BREAKPOINTS/MAX_WATCHPOINTS by switching
to dynamically allocated data structures that are kept in linked lists.
This also allows to return a stable reference to the related objects,
required for later introduced x86 debug register support.
Breakpoints and watchpoints are stored with their full information set
and an additional flag field that makes them easily extensible for use
beyond pure guest debugging.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5738 c046a42c-6fe2-441c-8c8c-71466251a162
This patch refactors the way the CPU state is handled that is associated
with a TB. The basic motivation is to move more arch specific code out
of generic files. Specifically the long #ifdef clutter in tb_find_fast()
has to be overcome in order to avoid duplicating it for the gdb
watchpoint fixes (patch "Restore pc on watchpoint hits").
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5736 c046a42c-6fe2-441c-8c8c-71466251a162
as macros should be avoided when possible.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5735 c046a42c-6fe2-441c-8c8c-71466251a162
* target-sh/translate.c (gen_intermediate_code_internal): If
singlestep is enabled, update PC before stopping.
(Vladimir Prus)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5472 c046a42c-6fe2-441c-8c8c-71466251a162
The SH4 manual documents the swap.b instruction as follows:
SWAP.B Rm,Rn
Rm → swap lower 2 bytes → Rn
Current QEMU code, in addition to the above, also clears the high
16 bits. The immediate breakage I saw is that htonl function applied
to netmask of 255.255.255.0 gives 0, which breaks all networking.
(Vladimir Prus)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5471 c046a42c-6fe2-441c-8c8c-71466251a162
This patch adds check for all SH4 instructions which are
executed only in privileged mode.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5224 c046a42c-6fe2-441c-8c8c-71466251a162
fix a bug on 'sleep' instruction, which have caused halt of idle task.
As i386 'hlt' instruction does, it should save PC before sleep.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5220 c046a42c-6fe2-441c-8c8c-71466251a162
Trivial patch adding CPU listing and the ability to do per-subtype
CVR/PVR/PRR values. Presently SH7750R and SH7751R definitions are
provided, as these are the ones in present use in-tree.
The CVR value for SH7751R is intentionally restricted so the kernel
boots, though this will want to be switched to the proper CVR value
once system emulation has sufficiently stabilized.
This also makes it trivial to abstract subtype specific registers like
MMU_PTEA and to set up feature bits in line with the kernel probing for
things like conditionalizing FPU/DSP context.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5133 c046a42c-6fe2-441c-8c8c-71466251a162
Use uint32_t/i32 based types/ops to stay consistent with previous dyngen
code. Thanks to Paul Brook for noticing that.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5101 c046a42c-6fe2-441c-8c8c-71466251a162
(Shin-ichiro KAWASAKI, based on a patch from Andrzej Zaborowski)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5074 c046a42c-6fe2-441c-8c8c-71466251a162
When a TLB miss occurs while pre-decrement store instruction such as
"mov.l Rm, @-Rn" is executed, re-execution of such instruction cause
status confusion. Because pre Rn decrement is executed before TLB miss,
re-execution decrements Rn again.
In other words, in a translated instruction array, register status
should not modified before memory access instruction.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5069 c046a42c-6fe2-441c-8c8c-71466251a162
Some bugs on SH4 MMU are fixed.
- When a TLB entry is overwritten or invalidated, tlb_flush_page() should be
invoked to invalidate old entry.
- When a ASID is changed, tlb_flush() should be invoke to invalidate entries
which have old ASID.
- The check for shared bit in TLB entry causes multiple TLB hit exception.
As SH3's MMU, shared bit is ignored.
- ASID is used when MMUCR's SV bit or SR's MD bit is zero.
No need to check both bits are zero.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5068 c046a42c-6fe2-441c-8c8c-71466251a162
SH4 MMU's memory mapped TLB feature is implemented.
SH-Linux seems to write to memory mapped TLB to invalidate a TLB entry,
but does not to read it. So only memory write feature is implemented.
Work on memory read feature is left.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5067 c046a42c-6fe2-441c-8c8c-71466251a162
Two bugs about delay slot handlings are fixed.
- After an exception occurred in delay slot, the branch instruction
before delay slot should be executed again. To judge such re-execution
is necessery or not, delay slot status is kept in SH4 CPU data structure.
- When a branch instruction is placed at the end of memory segment,
the delay slot is placed at the start of next memory segment.
It means delay slot comes to the start of a translation block.
In such occasion, DELAY_SLOT_CLAREME flag is used to transmit status
between translation blocks. When an exception occurs on this kind of
delay slot, DELAY_SLOT_CLEARME flag cause a status confusion in exception
handling. DELAY_SLOT_CLEARME flag should be cleared on exceptions.
And some items are added to CPU status dump.
(Shin-ichiro KAWASAKI)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5066 c046a42c-6fe2-441c-8c8c-71466251a162
Fix a typo in my previous comming (spotted by Laurent Desnouges).
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4877 c046a42c-6fe2-441c-8c8c-71466251a162
Save and restore env->interrupt_request and env->halted.
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4817 c046a42c-6fe2-441c-8c8c-71466251a162
allowing support of more than 2 mmu access modes.
Add backward compatibility is_user variable in targets code when needed.
Implement per target cpu_mmu_index function, avoiding duplicated code
and #ifdef TARGET_xxx in softmmu core functions.
Implement per target mmu modes definitions. As an example, add PowerPC
hypervisor mode definition and Alpha executive and kernel modes definitions.
Optimize PowerPC case, precomputing mmu_idx when MSR register changes
and using the same definition in code translation code.
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3384 c046a42c-6fe2-441c-8c8c-71466251a162
