Re: [Qemu-devel] Re: [PATCH] target-sh4: fix 64-bit fmov to/from memory

[Aurelien Jarno <aurelien@aurel32.net>]

On Fri, Nov 21, 2008 at 11:30:43PM +0000, Måns Rullgård wrote:
> Aurelien Jarno <aurelien@aurel32.net> writes:
> 
> > On Fri, Nov 21, 2008 at 10:23:54PM +0000, Mans Rullgard wrote:
> >> When loading/storing a register pair, the even-numbered register
> >> always maps to the low 32 bits of memory independently of target
> >> endian configuration.
> >> 
> >> Signed-off-by: Mans Rullgard <mans@mansr.com>
> >> ---
> >>  target-sh4/translate.c |   61 ++++++++++++++++++++++++-----------------------
> >>  1 files changed, 31 insertions(+), 30 deletions(-)
> >> 
> >> diff --git a/target-sh4/translate.c b/target-sh4/translate.c
> >> index 84a3f40..74894e9 100644
> >> --- a/target-sh4/translate.c
> >> +++ b/target-sh4/translate.c
> >> @@ -991,31 +991,35 @@ static void _decode_opc(DisasContext * ctx)
> >>  	return;
> >>      case 0xf00a: /* fmov {F,D,X}Rm,@Rn - FPSCR: Nothing */
> >>  	if (ctx->fpscr & FPSCR_SZ) {
> >> -	    TCGv_i64 fp = tcg_temp_new_i64();
> >> -	    gen_load_fpr64(fp, XREG(B7_4));
> >> -	    tcg_gen_qemu_st64(fp, REG(B11_8), ctx->memidx);
> >> -	    tcg_temp_free_i64(fp);
> >> +	    TCGv addr_hi = tcg_temp_new();
> >> +	    int fr = XREG(B7_4);
> >> +	    tcg_gen_addi_i32(addr_hi, REG(B11_8), 4);
> >> +	    tcg_gen_qemu_st32(cpu_fregs[fr  ], REG(B11_8), ctx->memidx);
> >> +	    tcg_gen_qemu_st32(cpu_fregs[fr+1], addr_hi,	   ctx->memidx);
> >> +	    tcg_temp_free(addr_hi);
> >>  	} else {
> >>  	    tcg_gen_qemu_st32(cpu_fregs[FREG(B7_4)], REG(B11_8), ctx->memidx);
> >>  	}
> >>  	return;
> >>      case 0xf008: /* fmov @Rm,{F,D,X}Rn - FPSCR: Nothing */
> >>  	if (ctx->fpscr & FPSCR_SZ) {
> >> -	    TCGv_i64 fp = tcg_temp_new_i64();
> >> -	    tcg_gen_qemu_ld64(fp, REG(B7_4), ctx->memidx);
> >> -	    gen_store_fpr64(fp, XREG(B11_8));
> >> -	    tcg_temp_free_i64(fp);
> >> +	    TCGv addr_hi = tcg_temp_new();
> >> +	    int fr = XREG(B11_8);
> >> +	    tcg_gen_addi_i32(addr_hi, REG(B7_4), 4);
> >> +	    tcg_gen_qemu_ld32u(cpu_fregs[fr  ], REG(B7_4), ctx->memidx);
> >> +	    tcg_gen_qemu_ld32u(cpu_fregs[fr+1], addr_hi,   ctx->memidx);
> >> +	    tcg_temp_free(addr_hi);
> >>  	} else {
> >>  	    tcg_gen_qemu_ld32u(cpu_fregs[FREG(B11_8)], REG(B7_4), ctx->memidx);
> >>  	}
> >>  	return;
> >>      case 0xf009: /* fmov @Rm+,{F,D,X}Rn - FPSCR: Nothing */
> >>  	if (ctx->fpscr & FPSCR_SZ) {
> >> -	    TCGv_i64 fp = tcg_temp_new_i64();
> >> -	    tcg_gen_qemu_ld64(fp, REG(B7_4), ctx->memidx);
> >> -	    gen_store_fpr64(fp, XREG(B11_8));
> >> -	    tcg_temp_free_i64(fp);
> >> -	    tcg_gen_addi_i32(REG(B7_4),REG(B7_4), 8);
> >> +	    int fr = XREG(B11_8);
> >> +	    tcg_gen_qemu_ld32u(cpu_fregs[fr  ], REG(B7_4), ctx->memidx);
> >> +	    tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4);
> >> +	    tcg_gen_qemu_ld32u(cpu_fregs[fr+1], REG(B7_4), ctx->memidx);
> >> +	    tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4);
> >
> > This is wrong, the address register should only be incremented after the
> > last load instruction, so that it has the correct value in case of
> > exception.
> 
> You're quite right.  In fact, shouldn't the 32-bit values be loaded
> into a temporary locations (at least the first to be loaded) in case
> the second load generates an exception?  The manual doesn't seem to
> allow a partial load in such a situation, so I'd assume it's not safe.
> 

There is nothing in the manual, but on most CPUs the value in the
register is then defined as unpredictable. I don't think it is important
to preserve the register value at this point. Preserving the address
value is important so that the instruction could be re-executed after an
exception, like a TLB miss for example.

-- 
  .''`.  Aurelien Jarno	            | GPG: 1024D/F1BCDB73
 : :' :  Debian developer           | Electrical Engineer
 `. `'   aurel32@debian.org         | aurelien@aurel32.net
   `-    people.debian.org/~aurel32 | www.aurel32.net