From: Peter Maydell <peter.maydell@linaro.org>
To: qemu-devel@nongnu.org
Subject: [PULL 3/6] target/arm: Avoid writing to constant TCGv in trans_CSEL()
Date: Mon, 31 Jul 2023 15:15:30 +0100 [thread overview]
Message-ID: <20230731141533.3303894-4-peter.maydell@linaro.org> (raw)
In-Reply-To: <20230731141533.3303894-1-peter.maydell@linaro.org>
In commit 0b188ea05acb5 we changed the implementation of
trans_CSEL() to use tcg_constant_i32(). However, this change
was incorrect, because the implementation of the function
sets up the TCGv_i32 rn and rm to be either zero or else
a TCG temp created in load_reg(), and these TCG temps are
then in both cases written to by the emitted TCG ops.
The result is that we hit a TCG assertion:
qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed.
(or on a non-debug build, just produce a garbage result)
Adjust the code so that rn and rm are always writeable
temporaries whether the instruction is using the special
case "0" or a normal register as input.
Cc: qemu-stable@nongnu.org
Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
---
target/arm/tcg/translate.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 13c88ba1b9f..b71ac2d0d53 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -8799,7 +8799,7 @@ static bool trans_IT(DisasContext *s, arg_IT *a)
/* v8.1M CSEL/CSINC/CSNEG/CSINV */
static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
{
- TCGv_i32 rn, rm, zero;
+ TCGv_i32 rn, rm;
DisasCompare c;
if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
@@ -8817,16 +8817,17 @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
}
/* In this insn input reg fields of 0b1111 mean "zero", not "PC" */
- zero = tcg_constant_i32(0);
+ rn = tcg_temp_new_i32();
+ rm = tcg_temp_new_i32();
if (a->rn == 15) {
- rn = zero;
+ tcg_gen_movi_i32(rn, 0);
} else {
- rn = load_reg(s, a->rn);
+ load_reg_var(s, rn, a->rn);
}
if (a->rm == 15) {
- rm = zero;
+ tcg_gen_movi_i32(rm, 0);
} else {
- rm = load_reg(s, a->rm);
+ load_reg_var(s, rm, a->rm);
}
switch (a->op) {
@@ -8846,7 +8847,7 @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
}
arm_test_cc(&c, a->fcond);
- tcg_gen_movcond_i32(c.cond, rn, c.value, zero, rn, rm);
+ tcg_gen_movcond_i32(c.cond, rn, c.value, tcg_constant_i32(0), rn, rm);
store_reg(s, a->rd, rn);
return true;
--
2.34.1
next prev parent reply other threads:[~2023-07-31 14:16 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-31 14:15 [PULL 0/6] target-arm queue Peter Maydell
2023-07-31 14:15 ` [PULL 1/6] target/arm: Fix MemOp for STGP Peter Maydell
2023-07-31 14:15 ` [PULL 2/6] elf2dmp: Don't abandon when Prcb is set to 0 Peter Maydell
2023-07-31 14:15 ` Peter Maydell [this message]
2023-07-31 14:15 ` [PULL 4/6] target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-arm Peter Maydell
2023-07-31 14:15 ` [PULL 5/6] kvm: Fix crash due to access uninitialized kvm_state Peter Maydell
2023-07-31 14:15 ` [PULL 6/6] gdbstub: Fix client Ctrl-C handling Peter Maydell
2023-07-31 18:00 ` [PULL 0/6] target-arm queue Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230731141533.3303894-4-peter.maydell@linaro.org \
--to=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).