I no longer have the test readily available. So I tried to print the initial MSR and IP register contents from the QEMU monitor:
qemu-system-ppc -machine none -cpu 7400 -S -monitor stdio QEMU 5.0.93 monitor - type 'help' for more information (qemu) info registers NIP 00000000 LR 00000000 CTR 00000000 XER 00000000 CPU#0 MSR 00000000 HID0 00000000 HF 00000000 iidx 0 didx 0 Segmentation fault (core dumped) Unfortunately this lets qemu (tried 2.11.1(Debian 1:2.11+dfsg- 1ubuntu7.29) as well as 5.1.0-rc3) segfault; apparently the time-base is not initialized but still accessed when -machine == none. Yet another bug, it seems. The NIP and MSR seem wrong, however. I can generate an empty ppc_rom.bin and fool a prep machine under 2.11.1: till@tillp1 $ ls -l empty.bin -rw-r--r-- 1 till till 0 Aug 8 12:03 empty.bin till@tillp1 $ qemu-system-ppc -bios ./empty.bin -cpu 7400 -machine prep -S -monitor stdio QEMU 2.11.1 monitor - type 'help' for more information (qemu) info registers NIP fff00100 LR 00000000 CTR 00000000 XER 00000000 CPU#0 MSR 00000040 HID0 00000000 HF 00000000 iidx 3 didx 3 Here, the issue is fixed! Apparently it is fixed for the 'prep' machine but not 'none'. Unfortunately 'prep' is gone from 5.3.0 and 'none' is buggy; wait - it seems I can emulate 'prep' with '40p': till@tillp1 $ build/ppc-softmmu/qemu-system-ppc -machine 40p -cpu 7400 -S -monitor stdio QEMU 5.0.93 monitor - type 'help' for more information (qemu) info registers NIP fff00100 LR 00000000 CTR 00000000 XER 00000000 CPU#0 MSR 00000040 HID0 00000000 HF 00000000 iidx 3 didx 3 This looks good, so I suppose it is OK to close this bug. -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/811683 Title: 7400,7410,7450 cpus vector have wrong exception prefix at reset Status in QEMU: Incomplete Bug description: I have a proprietary ROM implementing system calls that are executed via the 'SC' instruction. I use qemu-0.14.1, qemu-system-ppc -M prep -cpu $CPU -bios my_bios -kernel my_kernel That works fine on a 604 (CPU=0x00040103) - but does not on an emulated 7400 (CPU=0x000c0209) or 7450 (CPU=0x80000201). I found that the emulator jumps to 0x00000c00 instead of 0xfff00c00. Probably this is due to a wrong setting in target-ppc/translate_init.c: init_excp_604() correctly sets env->hreset_vector=0xfff00000UL; but init_excp_7400() says env->hreset_vector=0x00000000UL; which seems wrong. (the 7400 manual says a hard-reset jumps initializes the prefix to 0xfff00000.) Likewise, init_excp_7450() (and probably other, related CPUs) are wrong. Indeed, when I change the value in init_excp_7400() to 0xfff00000UL then everything works as expected for me. To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/811683/+subscriptions
