diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2022-10-24 22:55:26 +1000 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2022-11-01 08:31:41 +1100 |
| commit | cc30dc441b44ad15f4adfb13d9a68cba6fa39a23 (patch) | |
| tree | f916f7faa1a1be4beba2bfa18729abc338e3d0e6 /target/openrisc | |
| parent | 5813c5c74a755fd0c1b10be38c6fdf5c54c468e4 (diff) | |
| download | qemu-cc30dc441b44ad15f4adfb13d9a68cba6fa39a23.zip qemu-cc30dc441b44ad15f4adfb13d9a68cba6fa39a23.tar.gz qemu-cc30dc441b44ad15f4adfb13d9a68cba6fa39a23.tar.bz2 | |
target/openrisc: Use cpu_unwind_state_data for mfspr
Since we do not plan to exit, use cpu_unwind_state_data
and extract exactly the data requested.
This is a bug fix, in that we no longer clobber dflag.
Consider:
l.j L2 // branch
l.mfspr r1, ppc // delay
L1: boom
L2: l.lwa r3, (r4)
Here, dflag would be set by cpu_restore_state (because that is the current
state of the cpu), but but not cleared by tb_stop on exiting the TB
(because DisasContext has recorded the current value as zero).
The next TB begins at L2 with dflag incorrectly set. If the load has a
tlb miss, then the exception will be delivered as per a delay slot:
with DSX set in the status register and PC decremented (delay slots
restart by re-executing the branch). This will cause the return from
interrupt to go to L1, and boom!
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'target/openrisc')
| -rw-r--r-- | target/openrisc/sys_helper.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c index a3508e4..dde2fa1 100644 --- a/target/openrisc/sys_helper.c +++ b/target/openrisc/sys_helper.c @@ -199,6 +199,7 @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd, target_ulong spr) { #ifndef CONFIG_USER_ONLY + uint64_t data[TARGET_INSN_START_WORDS]; MachineState *ms = MACHINE(qdev_get_machine()); OpenRISCCPU *cpu = env_archcpu(env); CPUState *cs = env_cpu(env); @@ -232,14 +233,20 @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd, return env->evbar; case TO_SPR(0, 16): /* NPC (equals PC) */ - cpu_restore_state(cs, GETPC(), false); + if (cpu_unwind_state_data(cs, GETPC(), data)) { + return data[0]; + } return env->pc; case TO_SPR(0, 17): /* SR */ return cpu_get_sr(env); case TO_SPR(0, 18): /* PPC */ - cpu_restore_state(cs, GETPC(), false); + if (cpu_unwind_state_data(cs, GETPC(), data)) { + if (data[1] & 2) { + return data[0] - 4; + } + } return env->ppc; case TO_SPR(0, 32): /* EPCR */ |