qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 1/3] PPC: Circumvent overflow in mtcrf


From: Laurent Desnogues
Subject: Re: [Qemu-devel] [PATCH 1/3] PPC: Circumvent overflow in mtcrf
Date: Mon, 2 Mar 2009 23:45:47 +0100

On Mon, Mar 2, 2009 at 6:07 PM, Alexander Graf <address@hidden> wrote:
> I had a segmentation fault in mtcrf, where ffs() returned 8 and the
> code then accessed cpu_crf[7 - 8].
>
> In order to circumvent this, I just put in an & 7 to the ffs result,
> so we'll never run negative. This is probably not correct, but makes
> things work for me so far.
>
> Signed-off-by: Alexander Graf <address@hidden>
> ---
>  target-ppc/translate.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/target-ppc/translate.c b/target-ppc/translate.c
> index 2a06e4c..2e7420f 100644
> --- a/target-ppc/translate.c
> +++ b/target-ppc/translate.c
> @@ -3937,7 +3937,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04, 0x00000801, 
> PPC_MISC)
>     crm = CRM(ctx->opcode);
>     if (likely((ctx->opcode & 0x00100000) || (crm ^ (crm - 1)) == 0)) {
>         TCGv_i32 temp = tcg_temp_new_i32();
> -        crn = ffs(crm);
> +        crn = ffs(crm) & 7;
>         tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
>         tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
>         tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);

I think the problem lies in the if;  could you try this?

    if (likely((ctx->opcode & 0x00100000))
        if (crm ^ (crm - 1)) == 0) {
            TCGv_i32 temp = tcg_temp_new_i32();
            crn = ffs(crm);
            tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
            tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
            tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);
            tcg_temp_free_i32(temp);
        }
    } else {

The Power spec says mtocrf is undefined if crm has not
exactly one bit set.  The patch above will just make it a nop
(and will also generate code for mtcrf when it should instead
of wrongly generating buggy code for mtocrf when crm is a
power of 2 no matter what bit 20 [or bit 11 in dumb reversed
bit numbering scheme of Power] is).


Laurent




reply via email to

[Prev in Thread] Current Thread [Next in Thread]