blob: 24f50f50837a9213a7d24af4eecf85781be5d924 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
ppc: 0.896
graphic: 0.887
debug: 0.762
device: 0.733
TCG: 0.726
performance: 0.677
semantic: 0.632
i386: 0.560
x86: 0.554
architecture: 0.524
assembly: 0.512
kernel: 0.510
vnc: 0.499
PID: 0.483
risc-v: 0.469
files: 0.448
network: 0.436
socket: 0.432
KVM: 0.423
peripherals: 0.397
permissions: 0.396
register: 0.388
VMM: 0.385
hypervisor: 0.349
boot: 0.346
arm: 0.263
user-level: 0.252
mistranslation: 0.215
virtual: 0.202
PPC: `spr_write_xer` doesn't set flag bits in `cpu_xer`
Description of problem:
`spr_write_xer()` does not set the `ca`, `ov`, `so`, `ca32`, `ov32` etc. flag bits in the `cpu_xer` variable.
In fact it copies all bits from the source `GPR` and _excludes_ each flag bit.
This is not a problem for execution since `spr_read_xer()` gets the flag bits from `cpu_ca/ov/so...` and not from `cpu_xer`.
Nonetheless it is problem for tools which trace the execution in QEMU (e.g. https://github.com/BinaryAnalysisPlatform/qemu).
A fix would be to remove the `~` in https://gitlab.com/qemu-project/qemu/-/blob/master/target/ppc/translate.c#L481
Steps to reproduce:
Haven't found out yet how to debug QEMU so the TCGv values can be investigated. But in general one need to:
- Execute a binary which executes something like:
```
r4 = 0xffffffffffffffff
mtxer r4
```
and check the `cpu_xer` value after the `xer` write.
Checking the debug logs (`in_asm,cpu`) doesn't work, since the `xer` value in the logs is not taken directly from `cpu_xer`.
Additional information:
Code ref: https://gitlab.com/qemu-project/qemu/-/blob/master/target/ppc/translate.c#L480-L483
|
