After a TLB miss exception, GPRs 0-3 must be restored on rfi.

This is managed by hreg_store_msr() which is called by do_rfi()

However, hreg_store_msr() does it if MSR[TGPR] is unset in the
passed MSR value.

The problem is that do_rfi() is given the content of SRR1 as
the value to be set in MSR, but TGPR bit is not part of SRR1
and that bit is used for something else and is sometimes set
to 1, leading to hreg_store_msr() not restoring GPRs.

So, do the same way as for POW bit, force clearing it.

Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Cedric Le Goater <clg@kaod.org>
Cc: Fabiano Rosas <farosas@linux.ibm.com>
---
 target/ppc/excp_helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index bc646c67a0..980f62fd79 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1164,6 +1164,10 @@ static void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)
     /* MSR:POW cannot be set by any form of rfi */
     msr &= ~(1ULL << MSR_POW);
 
+    /* MSR:TGPR cannot be set by any form of rfi */
+    if (env->flags & POWERPC_FLAG_TGPR)
+        msr &= ~(1ULL << MSR_TGPR);
+
 #if defined(TARGET_PPC64)
     /* Switching to 32-bit ? Crop the nip */
     if (!msr_is_64bit(env, msr)) {
-- 
2.33.1

On 1/20/22 11:39, Christophe Leroy wrote:
> After a TLB miss exception, GPRs 0-3 must be restored on rfi.
> 
> This is managed by hreg_store_msr() which is called by do_rfi()
> 
> However, hreg_store_msr() does it if MSR[TGPR] is unset in the
> passed MSR value.
> 
> The problem is that do_rfi() is given the content of SRR1 as
> the value to be set in MSR, but TGPR bit is not part of SRR1
> and that bit is used for something else and is sometimes set
> to 1, leading to hreg_store_msr() not restoring GPRs.
> 
> So, do the same way as for POW bit, force clearing it.

 From the specs :

   "The TGPR bit is cleared by an rfi instruction."

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Thanks,

C.

> 
> Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
> Cc: Cedric Le Goater <clg@kaod.org>
> Cc: Fabiano Rosas <farosas@linux.ibm.com>
> ---
>   target/ppc/excp_helper.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
> index bc646c67a0..980f62fd79 100644
> --- a/target/ppc/excp_helper.c
> +++ b/target/ppc/excp_helper.c
> @@ -1164,6 +1164,10 @@ static void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)
>       /* MSR:POW cannot be set by any form of rfi */
>       msr &= ~(1ULL << MSR_POW);
>   
> +    /* MSR:TGPR cannot be set by any form of rfi */
> +    if (env->flags & POWERPC_FLAG_TGPR)
> +        msr &= ~(1ULL << MSR_TGPR);
> +
>   #if defined(TARGET_PPC64)
>       /* Switching to 32-bit ? Crop the nip */
>       if (!msr_is_64bit(env, msr)) {
>