commit 04e0dc252203bfbc5b02c2d3d8757a005e304a39
Author: Richard Henderson <address@hidden>
Date:   Sun Jan 31 15:06:35 2010 -0800

    tcg-alpha: Fix problems in qemu_ld/st.
    
    Copy address to R0 in tcg_out_tlb_cmp, for use in helper path.
    Use entire TLB constant offset performing the ADDEND read.

diff --git a/tcg/alpha/tcg-target.c b/tcg/alpha/tcg-target.c
index 519edef..463b7ee 100644
--- a/tcg/alpha/tcg-target.c
+++ b/tcg/alpha/tcg-target.c
@@ -709,9 +709,10 @@ static void *qemu_st_helpers[4] = {
 static void tcg_out_tlb_cmp(TCGContext *s, int sizeop, int r0, int r1,
                             int addr_reg, int label1, long tlb_offset)
 {
+    int addrsizeop = TARGET_LONG_BITS == 32 ? 2 : 3;
     long val;
 
-    /* Mask the page, plus the low bits of the access, into R0.  Note
+    /* Mask the page, plus the low bits of the access, into TMP3.  Note
        that the low bits are added in order to catch unaligned accesses,
        as those bits won't be set in the TLB entry.  For 32-bit targets,
        force the high bits of the mask to be zero, as the high bits of
@@ -720,7 +721,7 @@ static void tcg_out_tlb_cmp(TCGContext *s, int sizeop, int r0, int r1,
     if (TARGET_LONG_BITS == 32) {
         val &= 0xffffffffu;
     }
-    tcg_out_andi(s, addr_reg, val, r0);
+    tcg_out_andi(s, addr_reg, val, TMP_REG3);
 
     /* Compute the index into the TLB into R1.  Again, note that the
        high bits of a 32-bit address must be cleared.  */
@@ -736,11 +737,14 @@ static void tcg_out_tlb_cmp(TCGContext *s, int sizeop, int r0, int r1,
     /* Load the word at (R1 + CPU_ENV + TLB_OFFSET).  Note that we
        arrange for a 32-bit load to be zero-extended.  */
     tcg_out_fmt_opr(s, INSN_ADDQ, r1, TCG_AREG0, r1);
-    tcg_out_ld_sz(s, TARGET_LONG_BITS == 32 ? 2 : 3,
-                  TMP_REG2, r1, tlb_offset);
+    tcg_out_ld_sz(s, addrsizeop, TMP_REG2, r1, tlb_offset);
 
-    /* Compare R0 with the value loaded from the TLB.  */
-    tcg_out_brcond(s, TCG_COND_NE, TMP_REG2, r0, 0, label1);
+    /* Copy the original address into R0.  This is needed on the
+       slow path through the helper function.  */
+    tcg_out_extend(s, addrsizeop, addr_reg, r0);
+
+    /* Compare TMP3 with the value loaded from the TLB.  */
+    tcg_out_brcond(s, TCG_COND_NE, TMP_REG2, TMP_REG3, 0, label1);
 }
 #endif /* SOFTMMU */
 
@@ -769,20 +773,12 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
     /* TLB Hit.  Note that Alpha statically predicts forward branch as
        not taken, so arrange the fallthru as the common case.
 
-       ADDR_REG contains the guest address, and R1 contains the pointer
-       to TLB_ENTRY.ADDR_READ.  We need to load TLB_ENTRY.ADDEND and
-       add it to ADDR_REG to get the host address.  */
+       R0 contains the guest address, and R1 contains the pointer
+       to CPU_ENV plus the TLB entry offset.  */
 
     tcg_out_ld(s, TCG_TYPE_I64, r1, r1,
-               offsetof(CPUTLBEntry, addend)
-               - offsetof(CPUTLBEntry, addr_read));
-
-    if (TARGET_LONG_BITS == 32) {
-        tcg_out_extend(s, 2, addr_reg, r0);
-        addr_reg = r0;
-    }
-
-    tcg_out_fmt_opr(s, INSN_ADDQ, addr_reg, r1, r0);
+               offsetof(CPUState, tlb_table[mem_index][0].addend));
+    tcg_out_fmt_opr(s, INSN_ADDQ, r0, r1, r0);
     val = 0;
 #else
     r0 = addr_reg;
@@ -841,20 +837,12 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
     /* TLB Hit.  Note that Alpha statically predicts forward branch as
        not taken, so arrange the fallthru as the common case.
 
-       ADDR_REG contains the guest address, and R1 contains the pointer
-       to TLB_ENTRY.ADDR_READ.  We need to load TLB_ENTRY.ADDEND and
-       add it to ADDR_REG to get the host address.  */
+       R0 contains the guest address, and R1 contains the pointer
+       to CPU_ENV plus the TLB entry offset.  */
 
     tcg_out_ld(s, TCG_TYPE_I64, r1, r1,
-               offsetof(CPUTLBEntry, addend)
-               - offsetof(CPUTLBEntry, addr_write));
-
-    if (TARGET_LONG_BITS == 32) {
-        tcg_out_extend(s, 2, addr_reg, r0);
-        addr_reg = r0;
-    }
-
-    tcg_out_fmt_opr(s, INSN_ADDQ, addr_reg, r1, r0);
+               offsetof(CPUState, tlb_table[mem_index][0].addend));
+    tcg_out_fmt_opr(s, INSN_ADDQ, r0, r1, r0);
     val = 0;
 #else
     r0 = addr_reg;