[Qemu-devel] SSE 'maxps' instruction bug?

[Julian Seward]

The program below tests the 'maxps' instruction.  When run on 
qemu-0.9.0, host amd64, guest x86, guest OS redhat8, it prints:

   f9a511d1 8d37d67f b34825b8 e2f40739

scp the binary to a Core 2 (real) machine and run:

   f9a511d1 22dcb9b9 b34825b8 e2f40739

Second 32-bit word is completely different.

This is 0.9.0 compiled from source using gcc-3.4.6, host openSuSE
10.2 on a Core 2 Duo in 64-bit mode.

Any ideas?  I grepped the 0.9.0 sources for "maxps" but couldn't
figure out where/how it is handled.

J



#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <malloc.h>
#include <string.h>

typedef  unsigned char  V128[16];
typedef  signed int     Int;

static void showV128 ( V128* v )
{
   Int i;
   for (i = 0; i < 16; i++) {
      printf("%02x", (Int)(*v)[i]);
      if (i > 0 && (i % 4) == 3) printf(" ");
   }
}

static V128 arg1 = { 0x28,0x9b,0x57,0xf7,0x22,0xdc,0xb9,0xb9,
                     0x0a,0xb3,0x8a,0xcf,0x73,0xbb,0xe4,0x0b };
static V128 arg2 = { 0xf9,0xa5,0x11,0xd1,0x8d,0x37,0xd6,0x7f,
                     0xb3,0x48,0x25,0xb8,0xe2,0xf4,0x07,0x39 };
static V128 res;

int main ( int argc, char** argv )
{
   __asm__ __volatile__(
      "movups (%0),%%xmm6\n\t"
      "movups (%1),%%xmm7\n\t"
      "maxps %%xmm6,%%xmm7\n\t"
      "movups %%xmm7, (%2)\n\t"
      : : "r"(&arg1), "r"(&arg2), "r"(&res)
      : "xmm6", "xmm7"
   );
   showV128( &res );
   printf("\n");
   return 0;
}

/* Output on qemu-0.9.0, host amd64, guest x86, guest OS redhat8:
   f9a511d1 8d37d67f b34825b8 e2f40739

   Run same binary on a Core 2:
   f9a511d1 22dcb9b9 b34825b8 e2f40739

   Second 32-bit word is completely different.
*/