diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2021-02-25 05:12:06 +0000 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2021-03-06 11:45:21 -0800 |
| commit | 707b45a2475e25709f0dee00f8fdf39d346ed21e (patch) | |
| tree | 6390cea032916f65a18ebd29202ee9bb445c45e2 /tcg/aarch64 | |
| parent | 91e92cad67caca3bc4b8e920ddb5c8ca64aac9e1 (diff) | |
| download | qemu-707b45a2475e25709f0dee00f8fdf39d346ed21e.zip qemu-707b45a2475e25709f0dee00f8fdf39d346ed21e.tar.gz qemu-707b45a2475e25709f0dee00f8fdf39d346ed21e.tar.bz2 | |
tcg/aarch64: Fix constant subtraction in tcg_out_addsub2
An hppa guest executing
0x000000000000e05c: ldil L%10000,r4
0x000000000000e060: ldo 0(r4),r4
0x000000000000e064: sub r3,r4,sp
produces
---- 000000000000e064 000000000000e068
sub2_i32 tmp0,tmp4,r3,$0x1,$0x10000,$0x0
after folding and constant propagation. Then we hit
tcg-target.c.inc:640: tcg_out_insn_3401: Assertion `aimm <= 0xfff' failed.
because aimm is in fact -16, but unsigned.
The ((bl < 0) ^ sub) condition which negates bl is incorrect and will
always lead to this abort. If the constant is positive, sub will make
it negative; if the constant is negative, sub will keep it negative.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'tcg/aarch64')
| -rw-r--r-- | tcg/aarch64/tcg-target.c.inc | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc index 1376cdc..ec0a86d 100644 --- a/tcg/aarch64/tcg-target.c.inc +++ b/tcg/aarch64/tcg-target.c.inc @@ -1410,10 +1410,10 @@ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd, } } -static inline void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl, - TCGReg rh, TCGReg al, TCGReg ah, - tcg_target_long bl, tcg_target_long bh, - bool const_bl, bool const_bh, bool sub) +static void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl, + TCGReg rh, TCGReg al, TCGReg ah, + tcg_target_long bl, tcg_target_long bh, + bool const_bl, bool const_bh, bool sub) { TCGReg orig_rl = rl; AArch64Insn insn; @@ -1423,11 +1423,13 @@ static inline void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl, } if (const_bl) { - insn = I3401_ADDSI; - if ((bl < 0) ^ sub) { - insn = I3401_SUBSI; + if (bl < 0) { bl = -bl; + insn = sub ? I3401_ADDSI : I3401_SUBSI; + } else { + insn = sub ? I3401_SUBSI : I3401_ADDSI; } + if (unlikely(al == TCG_REG_XZR)) { /* ??? We want to allow al to be zero for the benefit of negation via subtraction. However, that leaves open the |