From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LeBcW-0002Wr-Vu for qemu-devel@nongnu.org; Mon, 02 Mar 2009 12:08:01 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LeBcU-0002V2-Lj for qemu-devel@nongnu.org; Mon, 02 Mar 2009 12:07:59 -0500 Received: from [199.232.76.173] (port=43916 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LeBcU-0002Uw-CD for qemu-devel@nongnu.org; Mon, 02 Mar 2009 12:07:58 -0500 Received: from ns2.suse.de ([195.135.220.15]:51455 helo=mx2.suse.de) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LeBcT-0001qW-Nz for qemu-devel@nongnu.org; Mon, 02 Mar 2009 12:07:57 -0500 From: Alexander Graf Date: Mon, 2 Mar 2009 18:07:52 +0100 Message-Id: <1236013674-28082-2-git-send-email-agraf@suse.de> In-Reply-To: <1236013674-28082-1-git-send-email-agraf@suse.de> References: <1236013674-28082-1-git-send-email-agraf@suse.de> Subject: [Qemu-devel] [PATCH 1/3] PPC: Circumvent overflow in mtcrf Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: blauwirbel@gmail.com, Alexander Graf I had a segmentation fault in mtcrf, where ffs() returned 8 and the code then accessed cpu_crf[7 - 8]. In order to circumvent this, I just put in an & 7 to the ffs result, so we'll never run negative. This is probably not correct, but makes things work for me so far. Signed-off-by: Alexander Graf --- target-ppc/translate.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/target-ppc/translate.c b/target-ppc/translate.c index 2a06e4c..2e7420f 100644 --- a/target-ppc/translate.c +++ b/target-ppc/translate.c @@ -3937,7 +3937,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04, 0x00000801, PPC_MISC) crm = CRM(ctx->opcode); if (likely((ctx->opcode & 0x00100000) || (crm ^ (crm - 1)) == 0)) { TCGv_i32 temp = tcg_temp_new_i32(); - crn = ffs(crm); + crn = ffs(crm) & 7; tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]); tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4); tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf); -- 1.6.0.2