Re: [Qemu-devel] [PATCH 1/3] PPC: Circumvent overflow in mtcrf

[Laurent Desnogues <laurent.desnogues@gmail.com>]

On Mon, Mar 2, 2009 at 6:07 PM, Alexander Graf <agraf@suse.de> wrote:
> I had a segmentation fault in mtcrf, where ffs() returned 8 and the
> code then accessed cpu_crf[7 - 8].
>
> In order to circumvent this, I just put in an & 7 to the ffs result,
> so we'll never run negative. This is probably not correct, but makes
> things work for me so far.
>
> Signed-off-by: Alexander Graf <alex@csgraf.de>
> ---
>  target-ppc/translate.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/target-ppc/translate.c b/target-ppc/translate.c
> index 2a06e4c..2e7420f 100644
> --- a/target-ppc/translate.c
> +++ b/target-ppc/translate.c
> @@ -3937,7 +3937,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04, 0x00000801, PPC_MISC)
>     crm = CRM(ctx->opcode);
>     if (likely((ctx->opcode & 0x00100000) || (crm ^ (crm - 1)) == 0)) {
>         TCGv_i32 temp = tcg_temp_new_i32();
> -        crn = ffs(crm);
> +        crn = ffs(crm) & 7;
>         tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
>         tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
>         tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);

I think the problem lies in the if;  could you try this?

    if (likely((ctx->opcode & 0x00100000))
        if (crm ^ (crm - 1)) == 0) {
            TCGv_i32 temp = tcg_temp_new_i32();
            crn = ffs(crm);
            tcg_gen_trunc_tl_i32(temp, cpu_gpr[rS(ctx->opcode)]);
            tcg_gen_shri_i32(cpu_crf[7 - crn], temp, crn * 4);
            tcg_gen_andi_i32(cpu_crf[7 - crn], cpu_crf[7 - crn], 0xf);
            tcg_temp_free_i32(temp);
        }
    } else {

The Power spec says mtocrf is undefined if crm has not
exactly one bit set.  The patch above will just make it a nop
(and will also generate code for mtcrf when it should instead
of wrongly generating buggy code for mtocrf when crm is a
power of 2 no matter what bit 20 [or bit 11 in dumb reversed
bit numbering scheme of Power] is).


Laurent