The behaviour of r0 in the shadow register sets is definitely
underspecified, but I really don't believe that r0 is a normal
writeable register for everything except the crs=0 set, which
is what you've implemented here. My best guess is:
* registers are implemented as a pile of RAM, including r0
* on reset the set-0 r0 is reset to 0, but nothing else is
(this bit's actually in the spec)
* writes to r0 are always discarded, except for the special
case of wrprs
I'm tempted to suggest we should make our tbflags bit
"we know r0 is zero" -- the guest doesn't have many ways
to switch register set, basically I think just eret and taking
an external interrupt, and those either happen outside the
TB or are going to end the TB anyway. Can we make
cpu_get_tb_cpu_state() simply set the TB flag if
env->shadow_regs[crs][0] == 0
or have I missed something that means that won't work?