From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33608) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WJR1M-0003Pj-Ek for qemu-devel@nongnu.org; Fri, 28 Feb 2014 12:14:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WJR1G-0002Dg-D1 for qemu-devel@nongnu.org; Fri, 28 Feb 2014 12:14:48 -0500 Received: from mail-pb0-x22a.google.com ([2607:f8b0:400e:c01::22a]:34065) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WJR1G-0002DU-5g for qemu-devel@nongnu.org; Fri, 28 Feb 2014 12:14:42 -0500 Received: by mail-pb0-f42.google.com with SMTP id rr13so1025902pbb.1 for ; Fri, 28 Feb 2014 09:14:41 -0800 (PST) Received: from pike.twiddle.home (50-194-63-110-static.hfc.comcastbusiness.net. [50.194.63.110]) by mx.google.com with ESMTPSA id gj9sm8032107pbc.7.2014.02.28.09.14.39 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Feb 2014 09:14:40 -0800 (PST) Sender: Richard Henderson From: Richard Henderson Date: Fri, 28 Feb 2014 09:14:31 -0800 Message-Id: <1393607671-23305-4-git-send-email-rth@twiddle.net> In-Reply-To: <1393607671-23305-1-git-send-email-rth@twiddle.net> References: <1393607671-23305-1-git-send-email-rth@twiddle.net> Subject: [Qemu-devel] [PULL 3/3] target-i386: Fix ucomis and comis memory access List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org We were loading 16 bytes for both single and double-precision scalar comparisons. Reported-by: Alexander Bluhm Signed-off-by: Richard Henderson --- target-i386/translate.c | 46 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 36 insertions(+), 10 deletions(-) diff --git a/target-i386/translate.c b/target-i386/translate.c index aa985fa..707ebd5 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -4284,22 +4284,48 @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b, if (is_xmm) { op1_offset = offsetof(CPUX86State,xmm_regs[reg]); if (mod != 3) { + int sz = 4; + gen_lea_modrm(env, s, modrm); op2_offset = offsetof(CPUX86State,xmm_t0); - if (b1 >= 2 && ((b >= 0x50 && b <= 0x5f && b != 0x5b) || - b == 0xc2)) { - /* specific case for SSE single instructions */ + + switch (b) { + case 0x50 ... 0x5a: + case 0x5c ... 0x5f: + case 0xc2: + /* Most sse scalar operations. */ if (b1 == 2) { - /* 32 bit access */ - gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0); - tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_t0.XMM_L(0))); + sz = 2; + } else if (b1 == 3) { + sz = 3; + } + break; + + case 0x2e: /* ucomis[sd] */ + case 0x2f: /* comis[sd] */ + if (b1 == 0) { + sz = 2; } else { - /* 64 bit access */ - gen_ldq_env_A0(s, offsetof(CPUX86State, - xmm_t0.XMM_D(0))); + sz = 3; } - } else { + break; + } + + switch (sz) { + case 2: + /* 32 bit access */ + gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0); + tcg_gen_st32_tl(cpu_T[0], cpu_env, + offsetof(CPUX86State,xmm_t0.XMM_L(0))); + break; + case 3: + /* 64 bit access */ + gen_ldq_env_A0(s, offsetof(CPUX86State, xmm_t0.XMM_D(0))); + break; + default: + /* 128 bit access */ gen_ldo_env_A0(s, op2_offset); + break; } } else { rm = (modrm & 7) | REX_B(s); -- 1.8.5.3