Skip to contentSkip to conversation

ppc64: fix mtmsr behavior on 64-bit targets

PATCH In review Nathan Whitehorn 3 participants 12 messages May 31, 2011 – Jun 13, 2011

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 ppc64: fix mtmsr behavior on 64-bit targets

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

---
 target-ppc/translate.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +2 -3
index 9b3f90c..a60dbe9 100644
@@ -3886,7 +3886,6 @@ static void gen_mtmsr(DisasContext *ctx)
          */
         gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();
             tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
@@ -3895,9 +3894,9 @@ static void gen_mtmsr(DisasContext *ctx)
             tcg_temp_free(t1);
             gen_helper_store_msr(t0);
             tcg_temp_free(t0);
-        } else
-#endif
+#else
             gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);
+#endif
         /* Must stop the translation as machine state (may have) 

changed */

         /* Note that mtmsr is not always defined as 
context-synchronizing */
         gen_stop_exception(ctx);
#1 lore raw
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

r~

#2 lore raw
Quoted 8 lines · Richard Henderson
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
              TCGv t0 = tcg_temp_new();
              TCGv t1 = tcg_temp_new();

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

I'll fix that (and resend the patch), thanks. A note on this: it looks like a lot of code here incorrectly changes behavior depending on the setting of MSR[SF]. While most of them aren't checking the condition the wrong way, like here, MSR[SF] actually changes very few aspects of the processor's operation. Turning MSR[SF] on or off on a 64-bit CPU basically only affects whether it pays attention to the high 32-bits of addresses when doing loads, stores, and branches -- 64-bit arithmetic, comparisons, registers, etc. are all available whatever the setting of MSR[SF]. -Nathan

#3 lore raw
Quoted 11 lines · Nathan Whitehorn
Quoted 8 lines · Richard Henderson
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

I'll fix that (and resend the patch), thanks. A note on this: it looks like a lot of code here incorrectly changes behavior depending on the setting of MSR[SF]. While most of them aren't checking the condition the wrong way, like here, MSR[SF] actually changes very few aspects of the processor's operation. Turning MSR[SF] on or off on a 64-bit CPU basically only affects whether it pays attention to the high 32-bits of addresses when doing loads, stores, and branches -- 64-bit arithmetic, comparisons, registers, etc. are all available whatever the setting of MSR[SF].

Not sure I understand what you mean. You can't access the upper 32 bits since the instructions are not available when !SF. Also, some subtile behavior changes.

If you for example run "lis x,-1" in !SF on a 64-bit machine, the full register value becomes 0xffffffffffffffff while in SF mode it becomes 0xffffffff. Maybe there are some parts in the code that are not correct, but !SF on 64-bit is very subtile :).

Alex

#4 lore raw
Quoted 8 lines · Alexander Graf
Quoted 6 lines · Nathan Whitehorn
Quoted 5 lines · Richard Henderson
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
              TCGv t0 = tcg_temp_new();
              TCGv t1 = tcg_temp_new();
Quoted 7 lines
Quoted 4 lines
Quoted 3 lines

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

I'll fix that (and resend the patch), thanks. A note on this: it looks like a lot of code here incorrectly changes behavior depending on the setting of MSR[SF]. While most of them aren't checking the condition the wrong way, like here, MSR[SF] actually changes very few aspects of the processor's operation. Turning MSR[SF] on or off on a 64-bit CPU basically only affects whether it pays attention to the high 32-bits of addresses when doing loads, stores, and branches -- 64-bit arithmetic, comparisons, registers, etc. are all available whatever the setting of MSR[SF].

Not sure I understand what you mean. You can't access the upper 32 bits since the instructions are not available when !SF. Also, some subtile behavior changes.

If you for example run "lis x,-1" in !SF on a 64-bit machine, the full register value becomes 0xffffffffffffffff while in SF mode it becomes 0xffffffff. Maybe there are some parts in the code that are not correct, but !SF on 64-bit is very subtile :).

Is that actually true, though? The architecture manual says nothing about it, and on both Cell and 970 systems (the hardware I had handy), as well as IBM Systemsim, lis x,-1 gives 0xffffffffffffff00 irrespective of the value of MSR[SF]. -Nathan

#5 lore raw
Quoted 15 lines · Nathan Whitehorn
Quoted 14 lines · Alexander Graf
Quoted 12 lines · Nathan Whitehorn
Quoted 8 lines · Richard Henderson
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
              TCGv t0 = tcg_temp_new();
              TCGv t1 = tcg_temp_new();

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

I'll fix that (and resend the patch), thanks. A note on this: it looks like a lot of code here incorrectly changes behavior depending on the setting of MSR[SF]. While most of them aren't checking the condition the wrong way, like here, MSR[SF] actually changes very few aspects of the processor's operation. Turning MSR[SF] on or off on a 64-bit CPU basically only affects whether it pays attention to the high 32-bits of addresses when doing loads, stores, and branches -- 64-bit arithmetic, comparisons, registers, etc. are all available
whatever the setting of MSR[SF].

Quoted 6 lines
Quoted 3 lines

Not sure I understand what you mean. You can't access the upper 32 bits since the instructions are not available when !SF. Also, some subtile behavior changes.

If you for example run "lis x,-1" in !SF on a 64-bit machine, the full register value becomes 0xffffffffffffffff while in SF mode it becomes 0xffffffff. Maybe there are some parts in the code that are not correct, but !SF on 64-bit is very subtile :).

Is that actually true, though? The architecture manual says nothing about it, and on both Cell and 970 systems (the hardware I had handy), as well as IBM Systemsim, lis x,-1 gives 0xffffffffffffff00 irrespective of the value of MSR[SF]. -Nathan

Also, those instructions *are* available. That's the only way to turn 64-bit mode on, for instance: you need to grab the MSR, set one of the high bits, then mtmsrd (which is a 64-bit instruction). -Nathan

#6 lore raw
In reply to Nathan Whitehorn
Quoted 12 lines · Nathan Whitehorn
Quoted 11 lines · Alexander Graf
Quoted 9 lines · Nathan Whitehorn
Quoted 8 lines · Richard Henderson
Quoted 4 lines · Nathan Whitehorn

#if defined(TARGET_PPC64)

-        if (!ctx->sf_mode) {
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();

You're removing a scope in which these variables were defined. That seems wrong, at minimum.

Quoted 6 lines
Quoted 4 lines
Quoted 1 line

I'll fix that (and resend the patch), thanks. A note on this: it looks like a lot of code here incorrectly changes behavior depending on the setting of MSR[SF]. While most of them aren't checking the condition the wrong way, like here, MSR[SF] actually changes very few aspects of the processor's operation. Turning MSR[SF] on or off on a 64-bit CPU basically only affects whether it pays attention to the high 32-bits of addresses when doing loads, stores, and branches -- 64-bit arithmetic, comparisons, registers, etc. are all available whatever the setting of MSR[SF].

Not sure I understand what you mean. You can't access the upper 32 bits since the instructions are not available when !SF. Also, some subtile behavior changes.

If you for example run "lis x,-1" in !SF on a 64-bit machine, the full register value becomes 0xffffffffffffffff while in SF mode it becomes 0xffffffff. Maybe there are some parts in the code that are not correct, but !SF on 64-bit is very subtile :).

Is that actually true, though? The architecture manual says nothing about it, and on both Cell and 970 systems (the hardware I had handy), as well as IBM Systemsim, lis x,-1 gives 0xffffffffffffff00 irrespective of the value of MSR[SF].

Hrm, right. I don't remember the details, but back when I implemented book3s_32 guest support on book3s_64 KVM, I was running guest code with MSR_SF enabled which resulted in very odd results with negative values. Either way, I'll gladly compare patches to real hardware and the spec whenever you fix one of the misinterpretations of msr_sf :).

Alex

#7 lore raw

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

---
 target-ppc/translate.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +10 -11
index 59aef85..38d2e2e 100644
@@ -3884,18 +3884,17 @@ static void gen_mtmsr(DisasContext *ctx)
          */
         gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
-            TCGv t0 = tcg_temp_new();
-            TCGv t1 = tcg_temp_new();
-            tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
-            tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
-            tcg_gen_or_tl(t0, t0, t1);
-            tcg_temp_free(t1);
-            gen_helper_store_msr(t0);
-            tcg_temp_free(t0);
-        } else
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
+        tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
+        tcg_gen_or_tl(t0, t0, t1);
+        tcg_temp_free(t1);
+        gen_helper_store_msr(t0);
+        tcg_temp_free(t0);
+#else
+        gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);
 #endif
-            gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);
         /* Must stop the translation as machine state (may have) 

changed */

         /* Note that mtmsr is not always defined as 
context-synchronizing */
         gen_stop_exception(ctx);
#8 lore raw

Am 12.06.2011 um 17:49 schrieb Nathan Whitehorn <[email protected]>:

Quoted 17 lines

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

---
target-ppc/translate.c | 5 ++---

1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +0 -2
index 59aef85..38d2e2e 100644
@@ -3884,18 +3884,17 @@ static void gen_mtmsr(DisasContext *ctx)
         */
        gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
-            TCGv t0 = tcg_temp_new();

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3888

Quoted 10 lines
target-ppc/translate.c +2 -8
-            TCGv t1 = tcg_temp_new();
-            tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
-            tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
-            tcg_gen_or_tl(t0, t0, t1);
-            tcg_temp_free(t1);
-            gen_helper_store_msr(t0);
-            tcg_temp_free(t0);
-        } else
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();

You're declaring variables in mid-scope. Please open a new scope :).

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3891

Quoted 3 lines
target-ppc/translate.c +3 -0
+        tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
+        tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
+        tcg_gen_or_tl(t0, t0, t1);

While at it, this is a perfect scenario for the deposit tcg op! :)

If you feel like this is too cumbersome work for such a small patch, please let me know and I'll do the changes for you :)

Alex

Quoted 11 lines
target-ppc/translate.c +5 -1
+        tcg_temp_free(t1);
+        gen_helper_store_msr(t0);
+        tcg_temp_free(t0);
+#else
+        gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);
 #endif
-            gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);
        /* Must stop the translation as machine state (may have) changed */
        /* Note that mtmsr is not always defined as context-synchronizing */
        gen_stop_exception(ctx);
#9 lore raw
Quoted 25 lines · Alexander Graf

Am 12.06.2011 um 17:49 schrieb Nathan Whitehorn<[email protected]>:

Quoted 20 lines

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

---
target-ppc/translate.c | 5 ++---

1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +0 -5
index 59aef85..38d2e2e 100644
@@ -3884,18 +3884,17 @@ static void gen_mtmsr(DisasContext *ctx)
          */
         gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
-            TCGv t0 = tcg_temp_new();
-            TCGv t1 = tcg_temp_new();
-            tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
-            tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
Quoted 8 lines

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3888

Quoted 7 lines
target-ppc/translate.c +2 -5
-            tcg_gen_or_tl(t0, t0, t1);
-            tcg_temp_free(t1);
-            gen_helper_store_msr(t0);
-            tcg_temp_free(t0);
-        } else
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();

You're declaring variables in mid-scope. Please open a new scope :).

Does the gen_update_nip(ctx, ctx->nip); need to be first here? If not, we can just move it to the end and avoid the scoping issue.

Quoted 6 lines

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3891

Quoted 3 lines
target-ppc/translate.c +3 -0
+        tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
+        tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
+        tcg_gen_or_tl(t0, t0, t1);

While at it, this is a perfect scenario for the deposit tcg op! :)

If you feel like this is too cumbersome work for such a small patch, please let me know and I'll do the changes for you :)

I have no idea what that is, so I'd prefer you do it :) -Nathan

#10 lore raw
Quoted 35 lines · Nathan Whitehorn
Quoted 25 lines · Alexander Graf

Am 12.06.2011 um 17:49 schrieb Nathan Whitehorn<[email protected]>:

Quoted 20 lines

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

---
target-ppc/translate.c | 5 ++---

1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +0 -5
index 59aef85..38d2e2e 100644
@@ -3884,18 +3884,17 @@ static void gen_mtmsr(DisasContext *ctx)
         */
        gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
-            TCGv t0 = tcg_temp_new();
-            TCGv t1 = tcg_temp_new();
-            tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
-            tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
Quoted 8 lines

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3888

Quoted 7 lines
target-ppc/translate.c +2 -5
-            tcg_gen_or_tl(t0, t0, t1);
-            tcg_temp_free(t1);
-            gen_helper_store_msr(t0);
-            tcg_temp_free(t0);
-        } else
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();

You're declaring variables in mid-scope. Please open a new scope :).

Quoted 1 line

Does the gen_update_nip(ctx, ctx->nip); need to be first here? If not, we can just move it to the end and avoid the scoping issue.

It makes sure that we know the current instruction pointer in case an interrupt gets delivered for example. There's a hack to not require this for data protection interrupts, but others might. In general, we need this whenever we call a helper function that could manually raise an interrupt. helper_store_msr does this:

void helper_store_msr (target_ulong val)

{
    val = hreg_store_msr(env, val, 0);
    if (val != 0) {
        env->interrupt_request |= CPU_INTERRUPT_EXITTB;
        helper_raise_exception(val);
    }
}

So it needs to come before any call to gen_helper_store_msr :).

Quoted 8 lines
Quoted 6 lines

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3891

Quoted 3 lines
target-ppc/translate.c +3 -0
+        tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
+        tcg_gen_ext32u_tl(t1, cpu_gpr[rS(ctx->opcode)]);
+        tcg_gen_or_tl(t0, t0, t1);

While at it, this is a perfect scenario for the deposit tcg op! :)

If you feel like this is too cumbersome work for such a small patch, please let me know and I'll do the changes for you :)

I have no idea what that is, so I'd prefer you do it :)

It's a new tcg call that makes the above code a lot easier. Do you want to go for v3 without changing deposit then? That would be awesome :).

Alex

#11 lore raw
In reply to Nathan Whitehorn
Quoted 1 line · Nathan Whitehorn

The mtmsr instruction is required not to modify the upper 32-bits of the machine state register, but checks the current value of MSR[SF] to decide whether to do this. This has the effect of zeroing the upper 32 bits of the MSR whenever mtmsr is executed in 64-bit mode. Unconditionally preserve the upper 32-bits in mtmsr for TARGET_PPC64.

This patch is missing a Signed-off-by line. Without, I unfortunately can't take the code upstream yet. See http://wiki.qemu.org/Contribute/SubmitAPatch for details.

Quoted 10 lines

---
target-ppc/translate.c | 5 ++---

1 files changed, 2 insertions(+), 3 deletions(-)
target-ppc/translate.c +0 -0
index 9b3f90c..a60dbe9 100644

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3889

Quoted 5 lines
target-ppc/translate.c +0 -1
@@ -3886,7 +3886,6 @@ static void gen_mtmsr(DisasContext *ctx)
         */
        gen_update_nip(ctx, ctx->nip);
 #if defined(TARGET_PPC64)
-        if (!ctx->sf_mode) {
            TCGv t0 = tcg_temp_new();

This code needs reindenting.

target-ppc/translate.c static void gen_mtmsr(DisasContext *ctx) · line 3898

Quoted 10 lines
target-ppc/translate.c +1 -2
            TCGv t1 = tcg_temp_new();
            tcg_gen_andi_tl(t0, cpu_msr, 0xFFFFFFFF00000000ULL);
@@ -3895,9 +3894,9 @@ static void gen_mtmsr(DisasContext *ctx)
            tcg_temp_free(t1);
            gen_helper_store_msr(t0);
            tcg_temp_free(t0);
-        } else
-#endif
+#else
            gen_helper_store_msr(cpu_gpr[rS(ctx->opcode)]);

This does too

Functionality-wise it looks good to me.

Alex