From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:45770)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <nikunj@linux.vnet.ibm.com>) id 1bUTjK-0007rW-91
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:03:15 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <nikunj@linux.vnet.ibm.com>) id 1bUTjE-0003Zr-By
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:03:09 -0400
Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:62366)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <nikunj@linux.vnet.ibm.com>) id 1bUTjE-0003Zf-4T
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:03:04 -0400
Received: from pps.filterd (m0098404.ppops.net [127.0.0.1])
	by mx0a-001b2d01.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id
	u726sV98078986
	for <qemu-devel@nongnu.org>; Tue, 2 Aug 2016 03:03:02 -0400
Received: from e23smtp02.au.ibm.com (e23smtp02.au.ibm.com [202.81.31.144])
	by mx0a-001b2d01.pphosted.com with ESMTP id 24gravqgvp-1
	(version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT)
	for <qemu-devel@nongnu.org>; Tue, 02 Aug 2016 03:03:02 -0400
Received: from localhost
	by e23smtp02.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use
	Only! Violators will be prosecuted
	for <qemu-devel@nongnu.org> from <nikunj@linux.vnet.ibm.com>;
	Tue, 2 Aug 2016 17:02:59 +1000
From: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
In-Reply-To: <8721d012-151c-4502-ce7b-a3eeeebdcfe2@twiddle.net>
References: <1468346602-20700-1-git-send-email-nikunj@linux.vnet.ibm.com>
	<1468346602-20700-5-git-send-email-nikunj@linux.vnet.ibm.com>
	<8721d012-151c-4502-ce7b-a3eeeebdcfe2@twiddle.net>
Date: Tue, 02 Aug 2016 12:32:50 +0530
MIME-Version: 1.0
Content-Type: text/plain
Message-Id: <874m73ejqd.fsf@abhimanyu.i-did-not-set--mail-host-address--so-tickle-me>
Subject: Re: [Qemu-devel] [RFC 4/6] target-ppc: add cmprb instruction
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Richard Henderson <rth@twiddle.net>, qemu-ppc@nongnu.org, david@gibson.dropbear.id.au
Cc: qemu-devel@nongnu.org, aneesh.kumar@linux.vnet.ibm.com, Anton Blanchard <anton@samba.org>

Richard Henderson <rth@twiddle.net> writes:

> This is better implemented without branches, like
>
>    TCGv_i32 src1, src2, src2lo, src2hi;
>    TCGv_i32 crf = cpu_crf[cdfD(ctx->opcode)];
>
>    // allocate all 4 "src" temps
>
>    tcg_gen_trunc_tl_i32(src1, cpu_gpr[rA(ctx->opcode)]);
>    tcg_gen_trunc_tl_i32(src2, cpu_gpr[rB(ctx->opcode)]);
>

As the user input can pass something more than 0xFF, we need only the
RA(56:63). Anton's fuzzer test hit this bug. :-)

GPR06 0x0706050403021101
cmprb   cr5,1,r6,r6

Should be a match (RA = 0x01, RB=0x03021101), but fails

     tcg_gen_andi_i32(src1, src1, 0xFF);

Will send an fix patch, we can probably squash with the original one.

>    tcg_gen_ext8u_i32(src2lo, src2);
>    tcg_gen_shri_i32(src2, src2, 8);
>    tcg_gen_extu8_i32(src2hi, src2hi);
>
>    tcg_gen_setcond_tl(TCG_COND_LEU, src2lo, src2lo, src1);
>    tcg_gen_setcond_tl(TCG_COND_LEU, src2hi, src1, src2hi);
>    tcg_gen_and_tl(crf, src2lo, src2hi);
>
>    if (ctx->opcode & 0x00200000) {
>      tcg_gen_shri_i32(src2, src2, 8);
>      tcg_gen_ext8u_i32(src2lo, src2);
>      tcg_gen_shri_i32(src2, src2, 8);
>      tcg_gen_ext8u_i32(src2hi, src2);
>      tcg_gen_setcond_i32(TCG_COND_LEU, src2lo, src2lo, src1);
>      tcg_gen_setcond_i32(TCG_COND_LEU, src2hi, src1, src2hi);
>      tcg_gen_and_i32(src2lo, src2lo, src2hi);
>      tcg_gen_or_i32(crf, crf, src2lo);
>    }
>
>    tcg_gen_shli_i32(crf, crf, CRF_GT);
>
>    // free all 4 "src" temps

Regards
Nikunj