Re: [PATCH] target/arm: Avoid writing to constant TCGv in trans_CSEL()

[Richard Henderson]

On 7/27/23 03:39, Peter Maydell wrote:
> In commit 0b188ea05acb5 we changed the implementation of
> trans_CSEL() to use tcg_constant_i32(). However, this change
> was incorrect, because the implementation of the function
> sets up the TCGv_i32 rn and rm to be either zero or else
> a TCG temp created in load_reg(), and these TCG temps are
> then in both cases written to by the emitted TCG ops.
> The result is that we hit a TCG assertion:
>
> qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion 
> `!temp_readonly(ots)' failed.
>
> (or on a non-debug build, just produce a garbage result)
>
> Adjust the code so that rn and rm are always writeable
> temporaries whether the instruction is using the special
> case "0" or a normal register as input.
>
> Cc: qemu-stable@nongnu.org
> Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL")
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> These insns are v8.1M-only, which is why this bug has
> lingered for so long.
> ---
>   target/arm/tcg/translate.c | 15 ++++++++-------
>   1 file changed, 8 insertions(+), 7 deletions(-)


Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~