yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-07-20 02:38:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

tcg/aarch64: Fix constant subtraction in tcg_out_addsub2

Browse source 
An hppa guest executing

0x000000000000e05c: ldil L%10000,r4
0x000000000000e060: ldo 0(r4),r4
0x000000000000e064: sub r3,r4,sp

produces

---- 000000000000e064 000000000000e068
sub2_i32 tmp0,tmp4,r3,$0x1,$0x10000,$0x0

after folding and constant propagation. Then we hit

tcg-target.c.inc:640: tcg_out_insn_3401: Assertion `aimm <= 0xfff' failed.

because aimm is in fact -16, but unsigned.

The ((bl < 0) ^ sub) condition which negates bl is incorrect and will
always lead to this abort. If the constant is positive, sub will make
it negative; if the constant is negative, sub will keep it negative.

Backports 707b45a2475e25709f0dee00f8fdf39d346ed21e
This commit is contained in:
Richard Henderson 2021-03-09 13:16:27 -05:00 committed by Lioncash
parent e54d0916ef
commit 043d65862a
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
qemu/tcg/aarch64/tcg-target.inc.c
View file

@ -1402,7 +1402,7 @@ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
} }
} }
static inline void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl, static void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl,
TCGReg rh, TCGReg al, TCGReg ah, TCGReg rh, TCGReg al, TCGReg ah,
tcg_target_long bl, tcg_target_long bh, tcg_target_long bl, tcg_target_long bh,
bool const_bl, bool const_bh, bool sub) bool const_bl, bool const_bh, bool sub)
@ -1415,11 +1415,13 @@ static inline void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl,
} }
if (const_bl) { if (const_bl) {
insn = I3401_ADDSI; if (bl < 0) {
if ((bl < 0) ^ sub) {
insn = I3401_SUBSI;
bl = -bl; bl = -bl;
insn = sub ? I3401_ADDSI : I3401_SUBSI;
} else {
insn = sub ? I3401_SUBSI : I3401_ADDSI;
} }
if (unlikely(al == TCG_REG_XZR)) { if (unlikely(al == TCG_REG_XZR)) {
/* ??? We want to allow al to be zero for the benefit of /* ??? We want to allow al to be zero for the benefit of
negation via subtraction. However, that leaves open the negation via subtraction. However, that leaves open the