On Mon, Mar 2, 2009 at 6:07 PM, Alexander Graf <address@hidden> wrote:
I had a segmentation fault in mtcrf, where ffs() returned 8 and the
code then accessed cpu_crf[7 - 8].
In order to circumvent this, I just put in an & 7 to the ffs result,
so we'll never run negative. This is probably not correct, but makes
things work for me so far.
Signed-off-by: Alexander Graf <address@hidden>
---
target-ppc/translate.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 2a06e4c..2e7420f 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -3937,7 +3937,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04,
0x00000801, PPC_MISC)
crm = CRM(ctx->opcode);
if (likely((ctx->opcode & 0x00100000) || (crm ^ (crm - 1)) ==
0)) {
TCGv_i32 temp = tcg_temp_new_i32();
- crn = ffs(crm);
+ crn = ffs(crm) & 7;
tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);
I think the problem lies in the if; could you try this?
if (likely((ctx->opcode & 0x00100000))
if (crm ^ (crm - 1)) == 0) {
TCGv_i32 temp = tcg_temp_new_i32();
crn = ffs(crm);
tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);
tcg_temp_free_i32(temp);
}
} else {
The Power spec says mtocrf is undefined if crm has not
exactly one bit set. The patch above will just make it a nop
(and will also generate code for mtcrf when it should instead
of wrongly generating buggy code for mtocrf when crm is a
power of 2 no matter what bit 20 [or bit 11 in dumb reversed
bit numbering scheme of Power] is).