i386: fixed incorrect wrapping in an mmx helper

Signed-off-by: Vitaly Chipounov <vitaly@cyberhaven.io>
shadowPlusPlus · May 22, 2019 · 01eec93 · 01eec93
1 parent dc1181c
commit 01eec93
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 9 deletions.
diff --git a/src/target-i386/cpu.h b/src/target-i386/cpu.h
@@ -64,7 +64,7 @@
 #if defined(CONFIG_SYMBEX) && !defined(SYMBEX_LLVM_LIB)
 
 /* uncomment this to compile assertions in */
-/* #define DO_SANITY_CHECK */
+// #define DO_SANITY_CHECK
 
 #ifdef DO_SANITY_CHECK
 #define CHECK_ASSERT(x) assert(x)
@@ -154,9 +154,9 @@ static inline void __WR_env_large(CPUArchState *cpuState, unsigned offset, void
 }
 
 static inline uint64_t __RR_env_dyn(void *p, unsigned size) {
-    int off = (char *) p - (char *) env;
-    CHECK_ASSERT(size <= sizeof(uint64_t) && off >= 0 && (off + size) <= offsetof(CPUArchState, eip) &&
-                 "unexpected calling context");
+    int off = (uintptr_t) p - (uintptr_t) env;
+    CHECK_ASSERT(size <= sizeof(uint64_t) && ((uintptr_t) p >= (uintptr_t) env) && off >= 0 &&
+                 (off + size) <= offsetof(CPUArchState, eip) && "unexpected calling context");
 
     if (size <= sizeof(target_ulong)) {
         return __RR_env_raw(env, off, size);
@@ -167,9 +167,9 @@ static inline uint64_t __RR_env_dyn(void *p, unsigned size) {
 }
 
 static inline uint64_t __WR_env_dyn(void *p, unsigned size, uint64_t v) {
-    int off = (char *) p - (char *) env;
-    CHECK_ASSERT(size <= sizeof(uint64_t) && off >= 0 && (off + size) <= offsetof(CPUArchState, eip) &&
-                 "unexpected calling context");
+    int off = (uintptr_t) p - (uintptr_t) env;
+    CHECK_ASSERT(size <= sizeof(uint64_t) && ((uintptr_t) p >= (uintptr_t) env) && off >= 0 &&
+                 (off + size) <= offsetof(CPUArchState, eip) && "unexpected calling context");
 
     if (size <= sizeof(target_ulong)) {
         __WR_env_raw(env, off, v, size);

diff --git a/src/target-i386/ops_sse.h b/src/target-i386/ops_sse.h
@@ -390,8 +390,13 @@ void glue(helper_pmaddwd, SUFFIX)(Reg *d, Reg *s) {
     int i;
 
     for (i = 0; i < (2 << SHIFT); i++) {
-        W_D(d, L(i), (int16_t) R_S(s, W(2 * i)) *
-                         (int16_t) R_D(d, W(2 * i) + (int16_t) R_S(s, W(2 * i + 1)) * (int16_t) R_D(d, W(2 * i + 1))));
+        int16_t v1 = (int16_t) R_S(s, W(2 * i));
+        int16_t v2 = (int16_t) R_D(d, W(2 * i));
+
+        int16_t v11 = (int16_t) R_S(s, W(2 * i + 1));
+        int16_t v12 = (int16_t) R_D(d, W(2 * i + 1));
+
+        W_D(d, L(i), v1 * v2 + v11 * v12);
     }
 }