<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: Windows 10 (Vb) - OS/kernel version: 19045.5011 - Architecture: AMD64 - QEMU flavor: qemu-system-ppc - QEMU version: 9.1.50 - QEMU command line: <!-- Give the smallest, complete command line that exhibits the problem. If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log. --> ``` # the ISO here is https://github.com/Wack0/maciNTosh for mac99, compiled from commit f3e27b36 or later # anything before that won't get as far as enabling MSR_LE. # correct ISO uploaded below. ./qemu-system-ppc -M mac99,via=pmu-adb -g 1024x768x32 -cdrom nt_arcfw_mac99.iso -boot d ``` ## Emulated/Virtualized environment - Operating system: Windows NT (but not getting as far as even its bootloader) - OS/kernel version: 4.0 - Architecture: PowerPC (7400) ## Description of problem qemu does not emulate MSR_LE correctly for CPUs prior to PPC970. The implementation used in this scenario appears to be correct for newer PowerPC CPUs, but not for earlier ones. When MSR_LE is enabled on PowerPC G4 and prior CPUs, big endian accesses are performed, with the lower address bits XORed by a constant derived from the size of the access (8-bit: XOR 7, 16-bit: XOR 6, 32-bit: XOR 4, 64-bit and above: no operation). This means that anything loaded in big-endian mode, when byteswapped as 64-bit values, appears in the correct place in little endian mode. Any unaligned access is dealt with at the same time. I have not verified exactly what the real hardware does, but the following appears to be correct for 16- and 32-bit accesses (and technically 8-bit accesses too given that all operations but the XOR do nothing in that case): ```c // sizeof_access is the access size in bytes size_t temp = ea & (sizeof_access - 1); // get offset of unaligned access ea &= ~sizeof_access; // align the address ea ^= (sizeof(uint64_t) - sizeof_access); // perform MSR_LE swizzle ea -= temp; // correct the address for the unaligned access ``` Note that the algorithm can be run again on a swizzled address, which will compute the original non-swizzled address. Additionally, GDB memory accesses need to be performed byte-wise using the same algorithm. (there's probably a faster way to do this involving bswap64, though!) As for the rest of the system: different chipsets did different things. Some memory controllers (for example those used in early PReP systems) had an endianness swap bit that endianness swapped all of memory and MMIO correctly (given MSR_LE swizzled addresses); later systems with a PCI bus had an endianness swap bit in the PCI host controller (Apple "Bandit", Motorola MPC105/6/7) that endianness swapped PCI address space from the CPU side and provided a correct view of main memory from PCI DMA. I'm not sure how to implement any of that, hence testing with mac99, where the PCI host controller is big-endian only (there is a uni-north register to swap PCI endianness, but it isn't implemented in hardware and flipping it does nothing). On such systems, hardware access-related swapping must be handled in software. ## Steps to reproduce Booting from the correct `nt_arcfw_mac99.iso` will crash on a black screen instead of running the ppcel stage2 bootloader. ## Additional information <!-- Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant. --> The following patch is my implementation. This is my first attempt at QEMU TCG-related code; in some places it may be 'too' safe (running the swizzling algorithm again to revert it in case the EA is used again afterwards), and it also uses the "internal only" `tcg_temp_free_*` functions, to avoid wasting temporary variables. So hopefully some more experienced devs can improve it. [msr_le.patch](/uploads/3f829ac58d9943faa0cad7b817569f1d/msr_le.patch) The following ISO is the one used for testing. [nt_arcfw_mac99.iso](/uploads/16aa5406284bab55ada205d6598e399a/nt_arcfw_mac99.iso) <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->