Richard Henderson <r...@twiddle.net> writes:

> This is better implemented without branches, like
>
>    TCGv_i32 src1, src2, src2lo, src2hi;
>    TCGv_i32 crf = cpu_crf[cdfD(ctx->opcode)];
>
>    // allocate all 4 "src" temps
>
>    tcg_gen_trunc_tl_i32(src1, cpu_gpr[rA(ctx->opcode)]);
>    tcg_gen_trunc_tl_i32(src2, cpu_gpr[rB(ctx->opcode)]);
>

As the user input can pass something more than 0xFF, we need only the
RA(56:63). Anton's fuzzer test hit this bug. :-)

GPR06 0x0706050403021101
cmprb   cr5,1,r6,r6

Should be a match (RA = 0x01, RB=0x03021101), but fails

     tcg_gen_andi_i32(src1, src1, 0xFF);

Will send an fix patch, we can probably squash with the original one.

>    tcg_gen_ext8u_i32(src2lo, src2);
>    tcg_gen_shri_i32(src2, src2, 8);
>    tcg_gen_extu8_i32(src2hi, src2hi);
>
>    tcg_gen_setcond_tl(TCG_COND_LEU, src2lo, src2lo, src1);
>    tcg_gen_setcond_tl(TCG_COND_LEU, src2hi, src1, src2hi);
>    tcg_gen_and_tl(crf, src2lo, src2hi);
>
>    if (ctx->opcode & 0x00200000) {
>      tcg_gen_shri_i32(src2, src2, 8);
>      tcg_gen_ext8u_i32(src2lo, src2);
>      tcg_gen_shri_i32(src2, src2, 8);
>      tcg_gen_ext8u_i32(src2hi, src2);
>      tcg_gen_setcond_i32(TCG_COND_LEU, src2lo, src2lo, src1);
>      tcg_gen_setcond_i32(TCG_COND_LEU, src2hi, src1, src2hi);
>      tcg_gen_and_i32(src2lo, src2lo, src2hi);
>      tcg_gen_or_i32(crf, crf, src2lo);
>    }
>
>    tcg_gen_shli_i32(crf, crf, CRF_GT);
>
>    // free all 4 "src" temps

Regards
Nikunj


Reply via email to