>> if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
>> tcg_out_ext32u(s, base, addr_regl) >> - addr_regl = base >> + tcg_out_mov(s, TCG_TYPE_PTR, addr_regl, base) >> } >> if (guest_base == 0 && data_regl != addr_regl) { >> base = addr_regl > > This is wrong, because you're not allowed to modify the input operands. > > Try this, just a few lines lower in the function: > - tcg_out_movi(s, TCG_TYPE_PTR, base, guest_base) > - tcg_out_opc_reg(s, ALIAS_PADD, base, base, addr_regl) > + tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP0, guest_base) > + tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_TMP0, addr_regl) > Got it, but the real problem is for addr_regl instead of guest_base. Using your code for reference, I'll use TCG_TMP0 for addr_regl instead of modifying it, and then send patch of new version later. > > and you'll need the same change within tcg_out_qemu_st. I'll write a test demo to produce crash in tcg_out_qemu_st flow, and send another patch for that. > Better would be to reserve a register for the guest_base, like we do for ppc. > See all of the uses of TCG_GUEST_BASE_REG in tcg/ppc/tcg-target.inc.c. It uses base(TCG_REG_A0) for temperary use for guest_base in this case. Thanks a lot.