[Qemu-devel] [PATCH 1/3] PPC: Circumvent overflow in mtcrf

[Alexander Graf <agraf@suse.de>]

I had a segmentation fault in mtcrf, where ffs() returned 8 and the
code then accessed cpu_crf[7 - 8].

In order to circumvent this, I just put in an & 7 to the ffs result,
so we'll never run negative. This is probably not correct, but makes
things work for me so far.

Signed-off-by: Alexander Graf <alex@csgraf.de>
---
 target-ppc/translate.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 2a06e4c..2e7420f 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -3937,7 +3937,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04, 0x00000801, PPC_MISC)
     crm = CRM(ctx->opcode);
     if (likely((ctx->opcode & 0x00100000) || (crm ^ (crm - 1)) == 0)) {
         TCGv_i32 temp = tcg_temp_new_i32();
-        crn = ffs(crm);
+        crn = ffs(crm) & 7;
         tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
         tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
         tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);
-- 
1.6.0.2