Currently an unpredictable movw such as movw pc, 0x123
results in the tinycode and_i32 $0x123,$0x123,$0xfffffffc mov_i32 pc,$0x123 exit_tb $0x0 which is clearly a bug, writing to a constant is incorrect and discards the result of the mask. Fix this by adding a temporary in store_reg(). Signed-off-by: Anton Johansson <[email protected]> --- target/arm/tcg/translate.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index 5f64fed220..aeac27bbe4 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -303,20 +303,23 @@ TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs) marked as dead. */ void store_reg(DisasContext *s, int reg, TCGv_i32 var) { + TCGv_i32 masked_var = tcg_temp_new_i32(); + tcg_gen_mov_i32(masked_var, var); if (reg == 15) { /* In Thumb mode, we must ignore bit 0. * In ARM mode, for ARMv4 and ARMv5, it is UNPREDICTABLE if bits [1:0] * are not 0b00, but for ARMv6 and above, we must ignore bits [1:0]. * We choose to ignore [1:0] in ARM mode for all architecture versions. */ - tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3); + tcg_gen_andi_i32(masked_var, masked_var, s->thumb ? ~1 : ~3); s->base.is_jmp = DISAS_JUMP; s->pc_save = -1; } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) { /* For M-profile SP bits [1:0] are always zero */ - tcg_gen_andi_i32(var, var, ~3); + tcg_gen_andi_i32(masked_var, masked_var, ~3); } - tcg_gen_mov_i32(cpu_R[reg], var); + tcg_gen_mov_i32(cpu_R[reg], masked_var); + tcg_gen_discard_i32(masked_var); } /* -- 2.51.0
