From: "Kirill A. Korinsky" <[email protected]> OpenBSD writes zero to an edge triggered decrementer, then enters idle expecting its interrupt. QEMU defers the already due edge to a timer at the current virtual time, leaving the guest stalled.
Signed-off-by: Kirill A. Korinsky <[email protected]> Tested-by: Anushree Mathur <[email protected]> Tested-by: Mark Cave-Ayland <[email protected]> Suggested-by: Amit Machhiwal <[email protected]> --- hw/ppc/ppc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c index b123b4cc1c..6f99b61a28 100644 --- a/hw/ppc/ppc.c +++ b/hw/ppc/ppc.c @@ -885,6 +885,7 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, int64_t now, uint64_t *nextp, * an edge interrupt, so raise it here too. */ if (((flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) || + ((flags & PPC_DECR_ZERO_TRIGGERED) && value == 0) || ((flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0 && signed_decr >= 0)) { (*raise_excp)(cpu); @@ -1104,6 +1105,12 @@ void cpu_ppc_tb_init(CPUPPCState *env, uint32_t freq) if (is_book3s_arch2x(env)) { /* All Book3S 64bit CPUs implement level based DEC logic */ tb_env->flags |= PPC_DECR_UNDERFLOW_LEVEL; + } else { + /* + * Classic 32-bit edge-triggered decrementer: zero write fires + * immediately + */ + tb_env->flags |= PPC_DECR_ZERO_TRIGGERED; } /* Create new timer */ tb_env->decr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, -- 2.55.0
