[PATCH] target/hppa: Work around Fast TLB insert instruction for HP-UX 9

[PATCH] target/hppa: Work around Fast TLB insert instruction for HP-UX 9

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The HP-UX 9 kernel uses two TLB insert instructions (0x05315440 and
0x05385400), which seem to be wrongly encoded fast TLB instructions, but
similiar to the non-fast instructions idtlba r17,(r9) and
idtlbp r24,(r9).

It's not clear, if those undocumented instructions were used by mistake,
or intentionally. Either way, this patch allows qemu to handle those
instructions, so that a HP-UX 9 boot-CD can now boot somewhat further (but
still crashes due to other reasons afterwards).

Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/hppa/insns.decode |  4 ++--
 target/hppa/translate.c  | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/target/hppa/insns.decode b/target/hppa/insns.decode
index 13c6a55bf2..837a0b73e6 100644
--- a/target/hppa/insns.decode
+++ b/target/hppa/insns.decode
@@ -162,8 +162,8 @@ ixtlbx          000001 b:5 r:5 sp:2 0100000 addr:1 0 00000      data=1
 ixtlbx          000001 b:5 r:5 ... 000000 addr:1 0 00000        \
                 sp=%assemble_sr3x data=0
 
-# pcxl and pcxl2 Fast TLB Insert instructions
-ixtlbxf         000001 00000 r:5 00 0 data:1 01000 addr:1 0 00000
+# pcxl and pcxl2 Fast TLB Insert instructions (with HP-UX 9 workaround)
+ixtlbxf           000001 b:5 r:5 0- 0 data:1 01000 addr:1 0 00000
 
 # pa2.0 tlb insert idtlbt and iitlbt instructions
 ixtlbt          000001 r2:5 r1:5 000 data:1 100000 0 00000    # idtlbt
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 4e34822565..72bc881784 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -2666,6 +2666,17 @@ static bool trans_ixtlbxf(DisasContext *ctx, arg_ixtlbxf *a)
      *    return gen_illegal(ctx);
      */
 
+    /*
+     * The HP-UX 9 kernel uses two undocumented instructions 0x05315440 and
+     * 0x05385400, which seem to be wrongly encoded fast TLB instructions,
+     * similiar to idtlba r17,(r9) and idtlbp r24,(r9).
+     * To support HP-UX 9, check b against 0 (documented) and 9 (to allow the
+     * r9 case), and genenerate an illegal instruction trap otherwise.
+     */
+    if (a->b != 0 && a->b != 9) {
+        return gen_illegal(ctx);
+    }
+
     atl = tcg_temp_new_i64();
     stl = tcg_temp_new_i64();
     addr = tcg_temp_new_i64();
-- 
2.54.0

Re: [PATCH] target/hppa: Work around Fast TLB insert instruction for HP-UX 9

[Philippe Mathieu-Daudé]

On 3/7/26 00:42, Helge Deller wrote:
> From: Helge Deller <deller@gmx.de>
> 
> The HP-UX 9 kernel uses two TLB insert instructions (0x05315440 and
> 0x05385400), which seem to be wrongly encoded fast TLB instructions, but
> similiar to the non-fast instructions idtlba r17,(r9) and
> idtlbp r24,(r9).
> 
> It's not clear, if those undocumented instructions were used by mistake,
> or intentionally. Either way, this patch allows qemu to handle those
> instructions, so that a HP-UX 9 boot-CD can now boot somewhat further (but
> still crashes due to other reasons afterwards).
> 
> Signed-off-by: Helge Deller <deller@gmx.de>
> ---
>   target/hppa/insns.decode |  4 ++--
>   target/hppa/translate.c  | 11 +++++++++++
>   2 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/target/hppa/insns.decode b/target/hppa/insns.decode
> index 13c6a55bf2..837a0b73e6 100644
> --- a/target/hppa/insns.decode
> +++ b/target/hppa/insns.decode
> @@ -162,8 +162,8 @@ ixtlbx          000001 b:5 r:5 sp:2 0100000 addr:1 0 00000      data=1
>   ixtlbx          000001 b:5 r:5 ... 000000 addr:1 0 00000        \
>                   sp=%assemble_sr3x data=0
>   
> -# pcxl and pcxl2 Fast TLB Insert instructions
> -ixtlbxf         000001 00000 r:5 00 0 data:1 01000 addr:1 0 00000
> +# pcxl and pcxl2 Fast TLB Insert instructions (with HP-UX 9 workaround)
> +ixtlbxf           000001 b:5 r:5 0- 0 data:1 01000 addr:1 0 00000
>   
>   # pa2.0 tlb insert idtlbt and iitlbt instructions
>   ixtlbt          000001 r2:5 r1:5 000 data:1 100000 0 00000    # idtlbt
> diff --git a/target/hppa/translate.c b/target/hppa/translate.c
> index 4e34822565..72bc881784 100644
> --- a/target/hppa/translate.c
> +++ b/target/hppa/translate.c
> @@ -2666,6 +2666,17 @@ static bool trans_ixtlbxf(DisasContext *ctx, arg_ixtlbxf *a)
>        *    return gen_illegal(ctx);
>        */
>   
> +    /*
> +     * The HP-UX 9 kernel uses two undocumented instructions 0x05315440 and
> +     * 0x05385400, which seem to be wrongly encoded fast TLB instructions,
> +     * similiar to idtlba r17,(r9) and idtlbp r24,(r9).
> +     * To support HP-UX 9, check b against 0 (documented) and 9 (to allow the
> +     * r9 case), and genenerate an illegal instruction trap otherwise.

Typo "generate".

> +     */
> +    if (a->b != 0 && a->b != 9) {

s/&&/||/?

But since @b is not consumed otherwise, what about dropping it from
the decoder instead?

   ixtlbxf           000001 00000 r:5 0- 0 data:1 01000 addr:1 0 00000
   ixtlbxf           000001 01001 r:5 0- 0 data:1 01000 addr:1 0 00000

> +        return gen_illegal(ctx);
> +    }
> +
>       atl = tcg_temp_new_i64();
>       stl = tcg_temp_new_i64();
>       addr = tcg_temp_new_i64();

Re: [PATCH] target/hppa: Work around Fast TLB insert instruction for HP-UX 9

[Helge Deller]

On 7/3/26 03:58, Philippe Mathieu-Daudé wrote:
> On 3/7/26 00:42, Helge Deller wrote:
>> From: Helge Deller <deller@gmx.de>
>>
>> The HP-UX 9 kernel uses two TLB insert instructions (0x05315440 and
>> 0x05385400), which seem to be wrongly encoded fast TLB instructions, but
>> similiar to the non-fast instructions idtlba r17,(r9) and
>> idtlbp r24,(r9).
>>
>> It's not clear, if those undocumented instructions were used by mistake,
>> or intentionally. Either way, this patch allows qemu to handle those
>> instructions, so that a HP-UX 9 boot-CD can now boot somewhat further (but
>> still crashes due to other reasons afterwards).
>>
>> Signed-off-by: Helge Deller <deller@gmx.de>
>> ---
>>   target/hppa/insns.decode |  4 ++--
>>   target/hppa/translate.c  | 11 +++++++++++
>>   2 files changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/target/hppa/insns.decode b/target/hppa/insns.decode
>> index 13c6a55bf2..837a0b73e6 100644
>> --- a/target/hppa/insns.decode
>> +++ b/target/hppa/insns.decode
>> @@ -162,8 +162,8 @@ ixtlbx          000001 b:5 r:5 sp:2 0100000 addr:1 0 00000      data=1
>>   ixtlbx          000001 b:5 r:5 ... 000000 addr:1 0 00000        \
>>                   sp=%assemble_sr3x data=0
>> -# pcxl and pcxl2 Fast TLB Insert instructions
>> -ixtlbxf         000001 00000 r:5 00 0 data:1 01000 addr:1 0 00000
>> +# pcxl and pcxl2 Fast TLB Insert instructions (with HP-UX 9 workaround)
>> +ixtlbxf           000001 b:5 r:5 0- 0 data:1 01000 addr:1 0 00000
>>   # pa2.0 tlb insert idtlbt and iitlbt instructions
>>   ixtlbt          000001 r2:5 r1:5 000 data:1 100000 0 00000    # idtlbt
>> diff --git a/target/hppa/translate.c b/target/hppa/translate.c
>> index 4e34822565..72bc881784 100644
>> --- a/target/hppa/translate.c
>> +++ b/target/hppa/translate.c
>> @@ -2666,6 +2666,17 @@ static bool trans_ixtlbxf(DisasContext *ctx, arg_ixtlbxf *a)
>>        *    return gen_illegal(ctx);
>>        */
>> +    /*
>> +     * The HP-UX 9 kernel uses two undocumented instructions 0x05315440 and
>> +     * 0x05385400, which seem to be wrongly encoded fast TLB instructions,
>> +     * similiar to idtlba r17,(r9) and idtlbp r24,(r9).
>> +     * To support HP-UX 9, check b against 0 (documented) and 9 (to allow the
>> +     * r9 case), and genenerate an illegal instruction trap otherwise.
> 
> Typo "generate".
> 
>> +     */
>> +    if (a->b != 0 && a->b != 9) {
> 
> s/&&/||/?
> 
> But since @b is not consumed otherwise, what about dropping it from
> the decoder instead?
> 
>    ixtlbxf           000001 00000 r:5 0- 0 data:1 01000 addr:1 0 00000
>    ixtlbxf           000001 01001 r:5 0- 0 data:1 01000 addr:1 0 00000

Yes, that's better.
I'll fix it accordingly.

Thanks!
Helge