diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-06-01 21:35:14 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-06-01 21:35:14 +0200 |
| commit | 3e4c5a6261770bced301b5e74233e7866166ea5b (patch) | |
| tree | 9379fddaba693ef8a045da06efee8529baa5f6f4 /gitlab/issues_text/target_m68k/host_missing/accel_TCG | |
| parent | e5634e2806195bee44407853c4bf8776f7abfa4f (diff) | |
| download | qemu-analysis-3e4c5a6261770bced301b5e74233e7866166ea5b.tar.gz qemu-analysis-3e4c5a6261770bced301b5e74233e7866166ea5b.zip | |
clean up repository
Diffstat (limited to 'gitlab/issues_text/target_m68k/host_missing/accel_TCG')
5 files changed, 0 insertions, 513 deletions
diff --git a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/1206 b/gitlab/issues_text/target_m68k/host_missing/accel_TCG/1206 deleted file mode 100644 index 939278468..000000000 --- a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/1206 +++ /dev/null @@ -1,96 +0,0 @@ -68k: movew %sp@+,%sr does not restore USP if switching from Supervisor to User mode -Description of problem: -Debugging issues with MacOS under qemu-system-m68k shows that the `movew %sp@+,%sr` instruction does not restore USP if switching from Supervisor to User mode. I've created a reproducer at https://gitlab.com/mcayland/qemu/-/commits/68k-move-to-sr-bug ([diff from git master](https://gitlab.com/mcayland/qemu/-/commit/fbcd078946c0e582bf8f1ac9a5a3a31cda2e6c38.diff)) which uses the following code snippet: - -``` -0x40800000 in MYROM () -warning: shared library handler failed to enable breakpoint -(gdb) disas $pc $pc+0x20 -Dump of assembler code from 0x40800000 to 0x40800020: -0x40800000 <MYROM+0>: lea 0x6000,%a0 -0x40800006 <MYROM+6>: movel %a0,%usp -0x40800008 <MYROM+8>: movew %sr,%d0 -0x4080000a <MYROM+10>: andiw #8191,%d0 -0x4080000e <MYROM+14>: movew %d0,%sp@- -0x40800010 <MYROM+16>: movew %sp@+,%sr -0x40800012 <MYROM+18>: bras 0x40800012 <MYROM+18> -``` - -Initially the ISP is set to 0x1000 in supervisor mode: the code above loads 0x6000 into %usp, moves the SR register into d0, clears the supervisor bit, and pushes the new SR value onto the stack. Finally the `movew %sp@+,%sr` instruction is executed which switches from supervisor mode to user mode but the resulting %sp is still the ISP value and not the USP: - -``` -0x40800000 in MYROM () -warning: shared library handler failed to enable breakpoint -(gdb) stepi -0x40800006 in MYROM () -(gdb) -0x40800008 in MYROM () -(gdb) -0x4080000a in MYROM () -(gdb) -0x4080000e in MYROM () -(gdb) -0x40800010 in MYROM () -(gdb) -0x40800010 in MYROM () -(gdb) i r $ps $sp -ps 0x2700 9984 -sp 0xffe 0xffe -(gdb) stepi -0x40800012 in MYROM () -(gdb) i r $ps $sp -ps 0x700 1792 -sp 0x1000 0x1000 <-- should be 0x6000 -``` - -Analysis with gdb shows that the `set_sr` helper is calling `m68k_switch_sp()` correctly but the resulting value is not seen in the guest: - -``` -Thread 3 "qemu-system-m68" hit Breakpoint 1, m68k_switch_sp (env=0x62d000030ae0) at ../target/m68k/helper.c:462 -462 env->sp[env->current_sp] = env->aregs[7]; -(gdb) p/x env->aregs[7] -$1 = 0xffe -(gdb) n -463 if (m68k_feature(env, M68K_FEATURE_M68000)) { -(gdb) -464 if (env->sr & SR_S) { -(gdb) -472 new_sp = M68K_USP; -(gdb) -478 env->aregs[7] = env->sp[new_sp]; -(gdb) -479 env->current_sp = new_sp; -(gdb) -480 } -(gdb) p/x env->aregs[7] -$2 = 0x6000 -``` - -The bug seems to be caused by the post-increment operator clobbering the stack pointer with the ISP after the instruction has been translated: - -``` -IN: -0x40800010: movew %sp@+,%sr - -OP: - ld_i32 tmp0,env,$0xfffffffffffffff0 - brcond_i32 tmp0,$0x0,lt,$L0 - - ---- 40800010 00000000 - mov_i32 tmp0,$0x1 - st_i32 tmp0,env,$0xfffffffffffffc18 - qemu_ld_i32 tmp0,A7,leuw,0 - bswap16_i32 tmp0,tmp0,iz,oz - add_i32 tmp3,A7,$0x2 - call set_sr,$0x0,$0,env,tmp0 - mov_i32 CC_OP,$0x1 - mov_i32 PC,$0x40800012 - mov_i32 A7,tmp3 - exit_tb $0x0 - set_label $L0 - exit_tb $0x7fe118f30043 -``` - -Here tmp3 which is generated from the ISP is written back to A7 **after** `set_sr` has switched the stack pointer. This appears to be part of the `delay_set_areg` mechanism which was introduced in 8a1e52b69d ("target-m68k: Delay autoinc writeback"). - -From what I can see it isn't possible to easily change the order of the `set_sr` helper and applying the post-increment since the post-increment is handled automatically after the instruction is translated as part of `do_writebacks()`. diff --git a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2078 b/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2078 deleted file mode 100644 index bcd790e2e..000000000 --- a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2078 +++ /dev/null @@ -1,34 +0,0 @@ -Qemu crashes with SIGFPE on certain trapping arithmetic operations on m68k target -Description of problem: -I recently ported NetBSD to the Qemu m68k "virt" platform, and this was discovered when running NetBSD's automated tests. Certain arithmetic operation that will trap in the guest will crash Qemu. First case encountered is below. -Steps to reproduce: -1. Compile and run the following program in the m68k guest: - -``` -virt68k:thorpej 3$ cat crash-qemu.c -#include <limits.h> -#include <stdlib.h> - -int divisor = -1; - -int -main(int argc, char *argv[]) -{ - - if (argc > 1) - divisor = atoi(argv[1]); - - return INT_MIN / divisor; -} -virt68k:thorpej 4$ -``` - -Another minimal case would be: - -``` -move.l #-2147483648,%d0 -move.l #-1,%d1 -divsl.l %d1,%d1:%d0 -``` -Additional information: - diff --git a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2249 b/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2249 deleted file mode 100644 index 7bbaa744a..000000000 --- a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2249 +++ /dev/null @@ -1,33 +0,0 @@ -[qemu-system-m68k] [q800] Ishar 1 makes Qemu crash -Description of problem: -qemu-system-m68k crashes when running the classic RPG game "Ishar", this is what can be seen on the TTY console on the host system: - -``` -qemu: fatal: DOUBLE MMU FAULT - -D0 = 000000af A0 = 000b91d2 F0 = 7fff ffffffffffffffff ( nan) -D1 = 00000074 A1 = 50f02000 F1 = 7fff ffffffffffffffff ( nan) -D2 = 00000000 A2 = 00067274 F2 = 7fff ffffffffffffffff ( nan) -D3 = f7f6f600 A3 = 40809be0 F3 = 7fff ffffffffffffffff ( nan) -D4 = f8ff2a2a A4 = 00000000 F4 = 7fff ffffffffffffffff ( nan) -D5 = 54aa0027 A5 = 007ef2b8 F5 = 7fff ffffffffffffffff ( nan) -D6 = 0000000a A6 = 000001e3 F6 = 7fff ffffffffffffffff ( nan) -D7 = ffffffe6 A7 = 0000000a F7 = 7fff ffffffffffffffff ( nan) -PC = 00067288 SR = 2218 T:0 I:2 SI XN--- -FPSR = 00000000 ---- - FPCR = 0000 X RN - A7(MSP) = 00000000 A7(USP) = 00000000 ->A7(ISP) = 0000000a -VBR = 0x00000000 -SFC = 0 DFC 5 -SSW 00000445 TCR 0000c000 URP 00000000 SRP 01ff6c00 -DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000 -MMUSR 00000000, fault at fffffffe -./mac: line 5: 806788 Aborted (core dumped) qemu-system-m68k -M q800 -m 32 -bios q800.rom -display sdl -audio driver=alsa -device scsi-hd,scsi-id=0,drive=hd0 -drive file=system71.img,media=disk,format=raw,if=none,id=hd0 -display sdl -``` -Steps to reproduce: -1. Download Ishar 1 Color version (available in https://www.grenier-du-mac.net/fiches/Jeux/ishar1.htm, on the lower part of the page). -2. Copy it to the emulated system and decompress the .sit archive with Stuffit Expander 5.5 -3. Run the game by clicking on it's icon and clicking on "Commandes->Jouer" or pressing Command+J -4. Watch it making qemu-system-m68k crash'n burn! -Additional information: -The same game works fine on current MAME Mac II/Ci emulation, etc. diff --git a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2290 b/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2290 deleted file mode 100644 index 94588f75c..000000000 --- a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/2290 +++ /dev/null @@ -1,143 +0,0 @@ -Wrong multiplication result of 'long double' on m68k -Description of problem: -In both x86 and m68k, 'long double' is an 80-bit format consisting of - - 1 bit sign, 15 bits exponent, - - 1 explicit 1 bit, 63 fraction bits. - -According to <https://en.wikipedia.org/wiki/Extended_precision> and -<https://www.nxp.com/docs/en/reference-manual/M68000PRM.pdf> table 1-6 (page 1-23), with two differences: - - In m68k, there are 16 zero bits as filler after the sign/exponent - word, so that the total size is 96 bits. - - In x86, the minimum exponent of normalized numbers is 1; - in m68k, the minimum exponent of normalized numbers is 0. - -The latter difference is reflected in the values of LDBL_MIN_EXP and -LDBL_MIN in gcc: - -In x86: -``` -$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN_EXP_ -#define LDBL_MIN_EXP __LDBL_MIN_EXP__ -#define __LDBL_MIN_EXP__ (-16381) -$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN__ -#define __LDBL_MIN__ 3.36210314311209350626267781732175260e-4932L -#define LDBL_MIN __LDBL_MIN__ -``` -In m68k (I use Debian 12/Linux): -``` -$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN_EXP_ -#define LDBL_MIN_EXP __LDBL_MIN_EXP__ -#define __LDBL_MIN_EXP__ (-16382) -$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN__ -#define __LDBL_MIN__ 1.68105157155604675313e-4932L -#define LDBL_MIN __LDBL_MIN__ -``` -Steps to reproduce: -Take this program, foo.c: -``` -/* Show extended-precision https://en.wikipedia.org/wiki/Extended_precision - multiplication bug in QEMU. */ - -#include <stdio.h> - -static void -show (const long double *p) -{ -#ifdef __m68k__ - printf("<S,E: 0x%08X M: 0x%08X%08X>", - ((const unsigned int *) p)[0], - ((const unsigned int *) p)[1], - ((const unsigned int *) p)[2]); -#else /* x86 */ - printf("<S,E: 0x%04X M: 0x%08X%08X>", - ((const unsigned short *) p)[4], - ((const unsigned int *) p)[1], - ((const unsigned int *) p)[0]); -#endif - printf (" = %La = %Lg", *p, *p); -} - -static void -show_mult (long double a, long double b) -{ - printf ("Factors: "); - show (&a); - printf ("\n and: "); - show (&b); - long double c = a * b; - printf ("\nProduct: "); - show (&c); - printf ("\n\n"); -} - -/* Return 2^n. */ -static long double -pow2l (int n) -{ - int k = n; - volatile long double x = 1; - volatile long double y = 2; - /* Invariant: 2^n == x * y^k. */ - if (k < 0) - { - y = 0.5L; - k = - k; - } - while (k > 0) - { - if (k != 2 * (k / 2)) - { - x = x * y; - k = k - 1; - } - if (k == 0) - break; - y = y * y; - k = k / 2; - } - /* Now k == 0, hence x == 2^n. */ - return x; -} - -int main () -{ - show_mult (pow2l (-16382), 0.5L); - show_mult (pow2l (-16381), 0.25L); - return 0; -} -``` -Its output on x86: -``` -$ ./a.out -Factors: <S,E: 0x0001 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 - and: <S,E: 0x3FFE M: 0x8000000000000000> = 0x8p-4 = 0.5 -Product: <S,E: 0x0000 M: 0x4000000000000000> = 0x4p-16385 = 1.68105e-4932 - -Factors: <S,E: 0x0002 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 - and: <S,E: 0x3FFD M: 0x8000000000000000> = 0x8p-5 = 0.25 -Product: <S,E: 0x0000 M: 0x4000000000000000> = 0x4p-16385 = 1.68105e-4932 -``` -Its output on m68k: -``` -$ ./a.out -Factors: <S,E: 0x00010000 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 - and: <S,E: 0x3FFE0000 M: 0x8000000000000000> = 0x8p-4 = 0.5 -Product: <S,E: 0x00000000 M: 0x4000000000000000> = 0x4p-16386 = 8.40526e-4933 - -Factors: <S,E: 0x00020000 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 - and: <S,E: 0x3FFD0000 M: 0x8000000000000000> = 0x8p-5 = 0.25 -Product: <S,E: 0x00000000 M: 0x4000000000000000> = 0x4p-16386 = 8.40526e-4933 -``` -The product, computed by QEMU, is incorrect. It is only half as large as the -correct value. The expected output should be: -``` -Factors: <S,E: 0x00010000 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 - and: <S,E: 0x3FFE0000 M: 0x8000000000000000> = 0x8p-4 = 0.5 -Product: <S,E: 0x00000000 M: 0x8000000000000000> = 0x8p-16386 = 1.68105e-4932 - -Factors: <S,E: 0x00020000 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 - and: <S,E: 0x3FFD0000 M: 0x8000000000000000> = 0x8p-5 = 0.25 -Product: <S,E: 0x00000000 M: 0x8000000000000000> = 0x8p-16386 = 1.68105e-4932 -``` -Additional information: -In QEMU's source code, I would guess that this multiplication is performed by the `floatx80_mul` function. diff --git a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/754 b/gitlab/issues_text/target_m68k/host_missing/accel_TCG/754 deleted file mode 100644 index d93ba56b5..000000000 --- a/gitlab/issues_text/target_m68k/host_missing/accel_TCG/754 +++ /dev/null @@ -1,207 +0,0 @@ -qem_m68k : trapcs instruction causes the non-execution of the following 2 instructions -Description of problem: -In try to run following code : -``` -8004615a: 204f moveal %sp,%a0 -8004615c: b1c7 cmpal %d7,%a0 -8004615e: 55fc trapcs -80046160: 4e56 0000 linkw %fp,#0 -80046164: 2f14 movel %a4@,%sp@- -80046166: 288e movel %fp,%a4@ -80046168: c74d exg %a3,%a5 -8004616a: 48e7 3030 moveml %d2-%d3/%a2-%a3,%sp@- -8004616e: 7001 moveq #1,%d0 -80046170: 3b40 816c movew %d0,%a5@(-32404) -80046174: 7218 moveq #24,%d1 -80046176: 3b41 816a movew %d1,%a5@(-32406) -8004617a: 242d 8004 movel %a5@(-32764),%d2 -8004617e: 2b42 815c movel %d2,%a5@(-32420) -80046182: 206d 8008 moveal %a5@(-32760),%a0 -80046186: 2268 8010 moveal %a0@(-32752),%a1 -8004618a: 2b49 8158 movel %a1,%a5@(-32424) -8004618e: 42ad 8154 clrl %a5@(-32428) -80046192: 246d 8154 moveal %a5@(-32428),%a2 -80046196: 2b4a 8160 movel %a2,%a5@(-32416) -8004619a: 2b4a 8164 movel %a2,%a5@(-32412) -8004619e: 422d 8168 clrb %a5@(-32408) -800461a2: 7604 moveq #4,%d3 -800461a4: 2b43 8150 movel %d3,%a5@(-32432) -800461a8: 2668 8010 moveal %a0@(-32752),%a3 -800461ac: 2b4b 814c movel %a3,%a5@(-32436) -800461b0: 2268 8010 moveal %a0@(-32752),%a1 -800461b4: 266d 8008 moveal %a5@(-32760),%a3 -800461b8: 206b 8008 moveal %a3@(-32760),%a0 -800461bc: 4e90 jsr %a0@ -800461be: 2b48 8148 movel %a0,%a5@(-32440) -800461c2: 4cdf 0c0c moveml %sp@+,%d2-%d3/%a2-%a3 -800461c6: c74d exg %a3,%a5 -800461c8: 289f movel %sp@+,%a4@ -800461ca: 4e5e unlk %fp -800461cc: 4e75 rts -``` -When I run qemu-m68k -cpu m68020 -d in_asm,cpu, I have : -``` ----------------- -IN: -0x8004615a: moveal %sp,%a0 -0x8004615c: cmpal %d7,%a0 -0x8004615e: trapcs -0x80046160: linkw %fp,#0 -0x80046164: movel %a4@,%sp@- -0x80046166: movel %fp,%a4@ -0x80046168: exg %a3,%a5 -0x8004616a: moveml %d2-%d3/%a2-%a3,%sp@- -0x8004616e: moveq #1,%d0 -0x80046170: movew %d0,%a5@(-32404) -0x80046174: moveq #24,%d1 -0x80046176: movew %d1,%a5@(-32406) -0x8004617a: movel %a5@(-32764),%d2 -0x8004617e: movel %d2,%a5@(-32420) -0x80046182: moveal %a5@(-32760),%a0 -0x80046186: moveal %a0@(-32752),%a1 -0x8004618a: movel %a1,%a5@(-32424) -0x8004618e: clrl %a5@(-32428) -0x80046192: moveal %a5@(-32428),%a2 -0x80046196: movel %a2,%a5@(-32416) -0x8004619a: movel %a2,%a5@(-32412) -0x8004619e: clrb %a5@(-32408) -0x800461a2: moveq #4,%d3 -0x800461a4: movel %d3,%a5@(-32432) -0x800461a8: moveal %a0@(-32752),%a3 -0x800461ac: movel %a3,%a5@(-32436) -0x800461b0: moveal %a0@(-32752),%a1 -0x800461b4: moveal %a5@(-32760),%a3 -0x800461b8: moveal %a3@(-32760),%a0 -0x800461bc: jsr %a0@ - -Trace 0: 0x7f83a807e780 [00000000/8004615a/00000000/00000000] -D0 = 00000012 A0 = 8004615a F0 = 7fff ffffffffffffffff ( nan) -D1 = 00000001 A1 = 800466d6 F1 = 7fff ffffffffffffffff ( nan) -D2 = 00000000 A2 = 00000000 F2 = 7fff ffffffffffffffff ( nan) -D3 = 00000000 A3 = 8000c3b0 F3 = 7fff ffffffffffffffff ( nan) -D4 = 00000000 A4 = 8004604c F4 = 7fff ffffffffffffffff ( nan) -D5 = 00000000 A5 = 3ffd7000 F5 = 7fff ffffffffffffffff ( nan) -D6 = 00000004 A6 = 80046038 F6 = 7fff ffffffffffffffff ( nan) -D7 = 80042050 A7 = 80045ff4 F7 = 7fff ffffffffffffffff ( nan) -PC SR = 0004 T:0 I:0 UI --Z-- -FPSR = 00000000 ---- - FPCR = 0000 X RN - - ----------------- -IN: -0x80046358: lea %a1@(0,%d0:l),%a0 -0x8004635c: rts - -Trace 0: 0x7f83a807eac0 [00000000/80046358/00000000/00000000] -D0 = 00000001 A0 = 80046358 F0 = 7fff ffffffffffffffff ( nan) -D1 = 00000018 A1 = 00000000 F1 = 7fff ffffffffffffffff ( nan) -D2 = ffffffff A2 = 00000000 F2 = 7fff ffffffffffffffff ( nan) -D3 = 00000004 A3 = 8000c040 F3 = 7fff ffffffffffffffff ( nan) -D4 = 00000000 A4 = 8004604c F4 = 7fff ffffffffffffffff ( nan) -D5 = 00000000 A5 = 8000c3b0 F5 = 7fff ffffffffffffffff ( nan) -D6 = 00000004 A6 = 80046038 F6 = 7fff ffffffffffffffff ( nan) -D7 = 80042050 A7 = 80045fe0 F7 = 7fff ffffffffffffffff ( nan) -PC = 80046358 SR = 0004 T:0 I:0 UI --Z-- -FPSR = 00000000 ---- - FPCR = 0000 X RN ----------------- -``` -Stack pointer is 80045fe0, it should be 80045FD8. - -When I run with options -cpu m68020 -d in_asm,cpu,op -singlestep, I have : -``` ----------------- -IN: -0x8004615e: trapcs -0x80046160: linkw %fp,#0 -Disassembler disagrees with translator over instruction decoding -Please report this to qemu-devel@nongnu.org - -OP: - ld_i32 tmp0,env,$0xfffffffffffffff8 - brcond_i32 tmp0,$0x0,lt,$L0 - - ---- 8004615e 00000000 - mov_i32 tmp0,$0x0 - call flush_flags,$0x0,$0,env,CC_OP - setcond_i32 tmp2,CC_C,tmp0,ne - neg_i32 tmp2,tmp2 - mov_i32 tmp0,$0x56 - mov_i32 PC,$0x80046162 - exit_tb $0x0 - set_label $L0 - exit_tb $0x7fba001a75c3 - -D0 = 00000012 A0 = 80045ff4 F0 = 7fff ffffffffffffffff ( nan) -D1 = 00000001 A1 = 800466d6 F1 = 7fff ffffffffffffffff ( nan) -D2 = 00000000 A2 = 00000000 F2 = 7fff ffffffffffffffff ( nan) -D3 = 00000000 A3 = 8000c3b0 F3 = 7fff ffffffffffffffff ( nan) -D4 = 00000000 A4 = 8004604c F4 = 7fff ffffffffffffffff ( nan) -D5 = 00000000 A5 = 3ffd5000 F5 = 7fff ffffffffffffffff ( nan) -D6 = 00000004 A6 = 80046038 F6 = 7fff ffffffffffffffff ( nan) -D7 = 80042050 A7 = 80045ff4 F7 = 7fff ffffffffffffffff ( nan) -PC = 8004615e SR = 0000 T:0 I:0 UI ----- -FPSR = 00000000 ---- - FPCR = 0000 X RN ----------------- -IN: -0x80046162: orib #20,%d0 - -OP: - ld_i32 tmp0,env,$0xfffffffffffffff8 - brcond_i32 tmp0,$0x0,lt,$L0 - - ---- 80046162 00000000 - mov_i32 tmp0,$0x14 - ext8s_i32 tmp3,D0 - or_i32 tmp4,tmp3,tmp0 - and_i32 D0,D0,$0xffffff00 - ext8u_i32 tmp6,tmp4 - or_i32 D0,D0,tmp6 - ext8s_i32 CC_N,tmp4 - discard CC_C - discard CC_Z - discard CC_V - mov_i32 CC_OP,$0xb - mov_i32 PC,$0x80046166 - exit_tb $0x0 - set_label $L0 - exit_tb $0x7fba001a7683 - -D0 = 00000012 A0 = 80045ff4 F0 = 7fff ffffffffffffffff ( nan) -D1 = 00000001 A1 = 800466d6 F1 = 7fff ffffffffffffffff ( nan) -D2 = 00000000 A2 = 00000000 F2 = 7fff ffffffffffffffff ( nan) -D3 = 00000000 A3 = 8000c3b0 F3 = 7fff ffffffffffffffff ( nan) -D4 = 00000000 A4 = 8004604c F4 = 7fff ffffffffffffffff ( nan) -D5 = 00000000 A5 = 3ffd5000 F5 = 7fff ffffffffffffffff ( nan) -D6 = 00000004 A6 = 80046038 F6 = 7fff ffffffffffffffff ( nan) -D7 = 80042050 A7 = 80045ff4 F7 = 7fff ffffffffffffffff ( nan) -PC = 80046162 SR = 0000 T:0 I:0 UI ----- -FPSR = 00000000 ---- - FPCR = 0000 X RN ----------------- -IN: -0x80046166: movel %fp,%a4@ - -OP: - ld_i32 tmp0,env,$0xfffffffffffffff8 - brcond_i32 tmp0,$0x0,lt,$L0 - -... -``` -I can see that instructions -``` -0x80046160: linkw %fp,#0 -0x80046164: movel %a4@,%sp@- -``` -are not executed -and an extra instruction -``` -0x80046162: orib #20,%d0 -``` -is executed -Steps to reproduce: -Run chroot qemu-m68k qemu-m68k-static -cpu m68020 -d in_asm,cpu -D log1.txt ./test -Additional information: - |