From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44820) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WICTa-0005lF-7g for qemu-devel@nongnu.org; Tue, 25 Feb 2014 02:30:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WICTV-0002Vu-M3 for qemu-devel@nongnu.org; Tue, 25 Feb 2014 02:30:50 -0500 Received: from mail-qa0-x235.google.com ([2607:f8b0:400d:c00::235]:54249) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WICTV-0002Vo-Hi for qemu-devel@nongnu.org; Tue, 25 Feb 2014 02:30:45 -0500 Received: by mail-qa0-f53.google.com with SMTP id cm18so17266qab.12 for ; Mon, 24 Feb 2014 23:30:45 -0800 (PST) Received: from pike.twiddle.home.com (50-194-63-110-static.hfc.comcastbusiness.net. [50.194.63.110]) by mx.google.com with ESMTPSA id i38sm29067766qge.1.2014.02.24.23.30.43 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 24 Feb 2014 23:30:44 -0800 (PST) Sender: Richard Henderson From: Richard Henderson Date: Mon, 24 Feb 2014 23:30:32 -0800 Message-Id: <1393313432-15327-4-git-send-email-rth@twiddle.net> In-Reply-To: <1393313432-15327-1-git-send-email-rth@twiddle.net> References: <1393313432-15327-1-git-send-email-rth@twiddle.net> Subject: [Qemu-devel] [PATCH 3/3] target-i386: Fix ucomis and comis memory access List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org We were loading 16 bytes for both single and double-precision scalar comparisons. Reported-by: Alexander Bluhm Signed-off-by: Richard Henderson --- The original Bluhm patch didn't fix [u]comiss, but was focused on [u]comisd. r~ --- target-i386/translate.c | 46 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 36 insertions(+), 10 deletions(-) diff --git a/target-i386/translate.c b/target-i386/translate.c index aa985fa..707ebd5 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -4284,22 +4284,48 @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b, if (is_xmm) { op1_offset = offsetof(CPUX86State,xmm_regs[reg]); if (mod != 3) { + int sz = 4; + gen_lea_modrm(env, s, modrm); op2_offset = offsetof(CPUX86State,xmm_t0); - if (b1 >= 2 && ((b >= 0x50 && b <= 0x5f && b != 0x5b) || - b == 0xc2)) { - /* specific case for SSE single instructions */ + + switch (b) { + case 0x50 ... 0x5a: + case 0x5c ... 0x5f: + case 0xc2: + /* Most sse scalar operations. */ if (b1 == 2) { - /* 32 bit access */ - gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0); - tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_t0.XMM_L(0))); + sz = 2; + } else if (b1 == 3) { + sz = 3; + } + break; + + case 0x2e: /* ucomis[sd] */ + case 0x2f: /* comis[sd] */ + if (b1 == 0) { + sz = 2; } else { - /* 64 bit access */ - gen_ldq_env_A0(s, offsetof(CPUX86State, - xmm_t0.XMM_D(0))); + sz = 3; } - } else { + break; + } + + switch (sz) { + case 2: + /* 32 bit access */ + gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0); + tcg_gen_st32_tl(cpu_T[0], cpu_env, + offsetof(CPUX86State,xmm_t0.XMM_L(0))); + break; + case 3: + /* 64 bit access */ + gen_ldq_env_A0(s, offsetof(CPUX86State, xmm_t0.XMM_D(0))); + break; + default: + /* 128 bit access */ gen_ldo_env_A0(s, op2_offset); + break; } } else { rm = (modrm & 7) | REX_B(s); -- 1.8.5.3