From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1HQluT-0005Xn-Vb
	for qemu-devel@nongnu.org; Mon, 12 Mar 2007 10:54:02 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1HQluR-0005Xb-Hf
	for qemu-devel@nongnu.org; Mon, 12 Mar 2007 10:54:00 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1HQluR-0005XY-Au
	for qemu-devel@nongnu.org; Mon, 12 Mar 2007 09:53:59 -0500
Received: from mtaout02-winn.ispmail.ntl.com ([81.103.221.48])
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <jseward@acm.org>) id 1HQltl-0003uT-BT
	for qemu-devel@nongnu.org; Mon, 12 Mar 2007 10:53:17 -0400
Received: from aamtaout04-winn.ispmail.ntl.com ([81.103.221.35])
	by mtaout02-winn.ispmail.ntl.com with ESMTP id
	<20070312145314.KDCU3103.mtaout02-winn.ispmail.ntl.com@aamtaout04-winn.ispmail.ntl.com>
	for <qemu-devel@nongnu.org>; Mon, 12 Mar 2007 14:53:14 +0000
Received: from phoenix2.frop.org ([82.21.100.63])
	by aamtaout04-winn.ispmail.ntl.com with ESMTP id
	<20070312145314.FOOZ29112.aamtaout04-winn.ispmail.ntl.com@phoenix2.frop.org>
	for <qemu-devel@nongnu.org>; Mon, 12 Mar 2007 14:53:14 +0000
From: Julian Seward <jseward@acm.org>
Date: Mon, 12 Mar 2007 14:50:41 +0000
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200703121450.41180.jseward@acm.org>
Subject: [Qemu-devel] SSE 'maxps' instruction bug?
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org


The program below tests the 'maxps' instruction.  When run on 
qemu-0.9.0, host amd64, guest x86, guest OS redhat8, it prints:

   f9a511d1 8d37d67f b34825b8 e2f40739

scp the binary to a Core 2 (real) machine and run:

   f9a511d1 22dcb9b9 b34825b8 e2f40739

Second 32-bit word is completely different.

This is 0.9.0 compiled from source using gcc-3.4.6, host openSuSE
10.2 on a Core 2 Duo in 64-bit mode.

Any ideas?  I grepped the 0.9.0 sources for "maxps" but couldn't
figure out where/how it is handled.

J



#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <malloc.h>
#include <string.h>

typedef  unsigned char  V128[16];
typedef  signed int     Int;

static void showV128 ( V128* v )
{
   Int i;
   for (i = 0; i < 16; i++) {
      printf("%02x", (Int)(*v)[i]);
      if (i > 0 && (i % 4) == 3) printf(" ");
   }
}

static V128 arg1 = { 0x28,0x9b,0x57,0xf7,0x22,0xdc,0xb9,0xb9,
                     0x0a,0xb3,0x8a,0xcf,0x73,0xbb,0xe4,0x0b };
static V128 arg2 = { 0xf9,0xa5,0x11,0xd1,0x8d,0x37,0xd6,0x7f,
                     0xb3,0x48,0x25,0xb8,0xe2,0xf4,0x07,0x39 };
static V128 res;

int main ( int argc, char** argv )
{
   __asm__ __volatile__(
      "movups (%0),%%xmm6\n\t"
      "movups (%1),%%xmm7\n\t"
      "maxps %%xmm6,%%xmm7\n\t"
      "movups %%xmm7, (%2)\n\t"
      : : "r"(&arg1), "r"(&arg2), "r"(&res)
      : "xmm6", "xmm7"
   );
   showV128( &res );
   printf("\n");
   return 0;
}

/* Output on qemu-0.9.0, host amd64, guest x86, guest OS redhat8:
   f9a511d1 8d37d67f b34825b8 e2f40739

   Run same binary on a Core 2:
   f9a511d1 22dcb9b9 b34825b8 e2f40739

   Second 32-bit word is completely different.
*/