Lifter: fsincos, fxam, fcmov, xlat, MXCSR; x87 NaN results as on the FPU

- fsincos (the D3DX rotation helpers), fxam, fcmovCC, xlatb and
  ldmxcsr/stmxcsr were trapped as unsupported and did nothing: 33 sites
  in the European build, 32 in the North American one.  fcmovCC reads
  EFLAGS, so the flag liveness counts its condition's flags as used.
  MXCSR is kept in the CPU state (power-on 0x1F80) but not applied.
- Two NaN operands: the x87 picks a quiet one over a signaling one,
  otherwise the larger significand, and always returns it quiet (SDM
  vol. 1, table 4-7); ARM took the first operand.  SSE keeps the first
  operand's NaN.
- isatest: 15 new cases (474 pass).

Author: TalhaMudo

runtime/cpu.h

@@ -46,6 +46,7 @@ typedef struct CPU {
     /* MMX (not shared with x87, kept separately) */
     uint64_t mm[8];
     /* SSE */
+    uint32_t mxcsr;      /* SSE control/status: only stored and read back (ldmxcsr/stmxcsr) */
     union { uint8_t b[16]; float f[4]; double d[2]; uint32_t u32[4]; uint64_t u64[2]; } xmm[8];
 } CPU;
 
@@ -150,6 +151,21 @@ static inline uint32_t parity8(uint32_t v){ v&=0xff; v^=v>>4; v^=v>>2; v^=v>>1;
 #define FSW_C1 (1u<<9)
 #define FSW_C2 (1u<<10)
 #define FSW_C3 (1u<<14)
+/* FXAM: the class of v in C3/C2/C0, its sign in C1.  The x87 registers carry no
+ * tags here, so "empty" (C3+C0) is never answered; a value counts as denormal
+ * by the double's range. */
+static inline uint16_t x87_class_bits(double v){
+    uint16_t k;
+    switch (fpclassify(v)){
+    case FP_NAN:       k = FSW_C0;          break;
+    case FP_INFINITE:  k = FSW_C2 | FSW_C0; break;
+    case FP_ZERO:      k = FSW_C3;          break;
+    case FP_SUBNORMAL: k = FSW_C3 | FSW_C2; break;
+    default:           k = FSW_C2;          break;
+    }
+    return signbit(v) ? (uint16_t)(k | FSW_C1) : k;
+}
+#define X87_EXAMINE(v) (c->fsw = (uint16_t)((c->fsw & (uint16_t)~(FSW_C0|FSW_C1|FSW_C2|FSW_C3)) | x87_class_bits(v)))
 /* fnstsw: on real hardware the TOP field (bits 11-13) is read too. */
 static inline uint16_t fsw_get(const struct CPU *c){
     return (uint16_t)((c->fsw & (uint16_t)~0x3800u) | (uint16_t)((c->top & 7u) << 11));
@@ -263,12 +279,30 @@ static inline double x87_round(uint16_t fcw, double v){
  * NaN, it must be fixed separately.  If one of the inputs is a NaN, that one
  * propagates.                                                            */
 #define X87_INDEF (-__builtin_nan(""))
-static inline double x87_r2(double a, double b, double r){
-    if (r == r) return r;
-    if (a != a) return a;
-    if (b != b) return b;
+/* A NaN operand of an x87 operation (Intel SDM vol. 1, table 4-7): the result is
+ * that NaN made quiet.  With two NaNs, a quiet one beats a signaling one, and of
+ * two of the same kind the larger significand wins (a, the destination, on a tie).
+ * ARM simply takes the first operand, so a two-NaN result differed from Windows.
+ * Out of line: the NaN path is cold and x87_r2 is inlined at every operation. */
+static inline double x87_quiet(double v){
+    uint64_t u; memcpy(&u, &v, 8); u |= 1ull << 51; memcpy(&v, &u, 8); return v;
+}
+static __attribute__((noinline, cold, unused)) double x87_nan2(double a, double b){
+    if (a != a && b != b){
+        uint64_t ua, ub; memcpy(&ua, &a, 8); memcpy(&ub, &b, 8);
+        unsigned qa = (unsigned)(ua >> 51) & 1u, qb = (unsigned)(ub >> 51) & 1u;
+        if (qa != qb) return qa ? a : b;
+        uint64_t sa = ua & 0x0007FFFFFFFFFFFFull, sb = ub & 0x0007FFFFFFFFFFFFull;
+        return x87_quiet(sb > sa ? b : a);
+    }
+    if (a != a) return x87_quiet(a);
+    if (b != b) return x87_quiet(b);
     return X87_INDEF;
 }
+static inline double x87_r2(double a, double b, double r){
+    if (__builtin_expect(r == r, 1)) return r;
+    return x87_nan2(a, b);
+}
 static inline double x87_r1(double a, double r){
     if (r == r) return r;
     if (a != a) return a;
@@ -285,7 +319,13 @@ static inline float sse_r1f(float a, float r){
     if (a != a) return a;
     return (float)X87_INDEF;
 }
-static inline double sse_r2d(double a, double b, double r){ return x87_r2(a,b,r); }
+/* SSE: the first operand's NaN wins whatever the second is (made quiet) */
+static inline double sse_r2d(double a, double b, double r){
+    if (r == r) return r;
+    if (a != a) return x87_quiet(a);
+    if (b != b) return x87_quiet(b);
+    return X87_INDEF;
+}
 static inline double sse_r1d(double a, double r){ return x87_r1(a,r); }
 
 /* Out of range / NaN -> "integer indefinite" (the most negative value). */

runtime/win32_ext.c

@@ -400,7 +400,7 @@ static void *guest_thread_main(void *p){
     mem_commit(stack_lo, GTHREAD_STACK);
     memset(g_mem + stack_lo, 0, GTHREAD_STACK);     /* a recycled slot starts clean */
     cpu.esp = stack_hi - 0x1000u;
-    cpu.top = 0; cpu.fcw = 0x037f;
+    cpu.top = 0; cpu.fcw = 0x037f; cpu.mxcsr = 0x1F80u;
     cpu.fs_base = t->teb; cpu.gs_base = t->teb;
     /* TEB */
     MR32(t->teb+0x00)=0xFFFFFFFFu; MR32(t->teb+0x04)=stack_hi; MR32(t->teb+0x08)=stack_lo;
@@ -466,7 +466,7 @@ static void *timer_thread_main(void *p){
     teb = 0x00C60000u;
     mem_commit(stack_lo, GTHREAD_STACK);
     mem_commit(teb, 0x2000);
-    cpu.top = 0; cpu.fcw = 0x037f;
+    cpu.top = 0; cpu.fcw = 0x037f; cpu.mxcsr = 0x1F80u;
     cpu.fs_base = teb; cpu.gs_base = teb;
     MR32(teb+0x00)=0xFFFFFFFFu; MR32(teb+0x04)=stack_hi; MR32(teb+0x08)=stack_lo;
     MR32(teb+0x18)=teb; MR32(teb+0x24)=999u;

tests/boot.c

@@ -175,7 +175,7 @@ int main(int argc,char**argv){
     { extern CPU *g_cur_cpu; g_cur_cpu = &cpu; }
     memset(&cpu,0,sizeof cpu);
     cpu.esp = STACK_HI - 0x1000u;
-    cpu.top = 0; cpu.fcw = 0x037f;
+    cpu.top = 0; cpu.fcw = 0x037f; cpu.mxcsr = 0x1F80u;
     cpu.fs_base = TEB_BASE;
     cpu.gs_base = TEB_BASE;
 

tools/isatest.py

@@ -343,6 +343,41 @@ def _rc(name, cw, val, want):
   {}, mem={FC+0x80:1,FC+0x84:2,FC+0x88:3,FC+0x8C:4},
   fmem={FC+0x90:3, FC+0x94:4})
 
+# ---------------- x87 / SSE control instructions the lifter used to trap ----------------
+FX = 0x00C74000
+T("fsincos 1.0: cos on top, sin below",
+  [0xD9,0x05]+a32(FX)+[0xD9,0xFB]+[0xD9,0x1D]+a32(FX+4)+[0xD9,0x1D]+a32(FX+8),
+  {}, memf={FX:1.0}, fmemf={FX+4:0.5403023058681398, FX+8:0.8414709848078965})
+T("fxam 2.0 -> normal (C2)",  [0xD9,0x05]+a32(FX+0x10)+[0xD9,0xE5,0xDF,0xE0,0xDD,0xD8],
+  {}, memf={FX+0x10:2.0}, expect={'ah_and':(0x47,0x04)})
+T("fxam -0.0 -> zero, sign (C3,C1)", [0xD9,0x05]+a32(FX+0x14)+[0xD9,0xE5,0xDF,0xE0,0xDD,0xD8],
+  {}, mem={FX+0x14:0x80000000}, expect={'ah_and':(0x47,0x42)})
+T("fxam +inf -> infinity (C2,C0)", [0xD9,0x05]+a32(FX+0x18)+[0xD9,0xE5,0xDF,0xE0,0xDD,0xD8],
+  {}, mem={FX+0x18:0x7F800000}, expect={'ah_and':(0x47,0x05)})
+# fld 7, fld 3 (ST0=3, ST1=7); a flag setter; fcmovCC st0,st1; fstp result; pop
+def _fcm(name, flagop, op, base, want):
+    T(name, [0xD9,0x05]+a32(base)+[0xD9,0x05]+a32(base+4)+flagop+op+[0xD9,0x1D]+a32(base+8)+[0xDD,0xD8],
+      {}, memf={base:7.0, base+4:3.0}, fmemf={base+8:want})
+_fcm("fcmovbe, CF=1 -> copies",        [0xF9],            [0xDA,0xD1], FX+0x20, 7.0)
+_fcm("fcmovnbe, CF=0 ZF=0 -> copies",  [0x83,0xC8,0x01],  [0xDB,0xD1], FX+0x30, 7.0)
+_fcm("fcmove, ZF=0 -> keeps",          [0x83,0xC8,0x01],  [0xDA,0xC9], FX+0x40, 3.0)
+_fcm("fcmovnb, CF=1 -> keeps",         [0xF9],            [0xDB,0xC1], FX+0x50, 3.0)
+T("xlatb: AL = [EBX+AL]", [0xD7], {'ebx':FX+0x60, 'eax':0xAABBCC02}, mem={FX+0x60:0x44332211},
+  expect={'eax':0xAABBCC33})
+T("stmxcsr: power-on value", [0x0F,0xAE,0x1D]+a32(FX+0x70), {}, fmem={FX+0x70:0x1F80})
+T("ldmxcsr then stmxcsr", [0x0F,0xAE,0x15]+a32(FX+0x74)+[0x0F,0xAE,0x1D]+a32(FX+0x78),
+  {}, mem={FX+0x74:0x00009FC0}, fmem={FX+0x78:0x00009FC0})
+
+# x87 NaN results (SDM vol. 1, table 4-7): fld qword a; fadd qword b; fstp qword r
+def _nan(name, a, b, want, base):
+    T(name, [0xDD,0x05]+a32(base)+[0xDC,0x05]+a32(base+8)+[0xDD,0x1D]+a32(base+16),
+      {}, mem={base:a & 0xffffffff, base+4:a >> 32, base+8:b & 0xffffffff, base+12:b >> 32},
+      fmem={base+16:want & 0xffffffff, base+20:want >> 32})
+_nan("x87 NaN: two QNaNs, larger second",   0x7FF8000000000001, 0x7FF8000000000100, 0x7FF8000000000100, FX+0x80)
+_nan("x87 NaN: two QNaNs, larger first",    0xFFF8000000000300, 0x7FF8000000000002, 0xFFF8000000000300, FX+0xA0)
+_nan("x87 NaN: QNaN beats a larger SNaN",   0x7FF7FFFFFFFFFFFF, 0x7FF8000000000001, 0x7FF8000000000001, FX+0xC0)
+_nan("x87 NaN: lone SNaN comes back quiet", 0x7FF0000000000100, 0x3FF0000000000000, 0x7FF8000000000100, FX+0xE0)
+
 # =====================  GENERATOR / RUNNER  =====================
 BASE = 0x00401000
 def build():
@@ -383,7 +418,7 @@ def gen_c(fns, body):
         if fns[i] is None: continue
         nm = t['name'].replace('"','\\"')
         o.append(f'  /* --- {i}: {nm} --- */')
-        o.append('  { memset(&cpu,0,sizeof cpu); cpu.esp=STK; cpu.top=0; cpu.fcw=0x037f;')
+        o.append('  { memset(&cpu,0,sizeof cpu); cpu.esp=STK; cpu.top=0; cpu.fcw=0x037f; cpu.mxcsr=0x1F80u;')
         for r,v in t['setup'].items():
             o.append(f'    cpu.{r} = 0x{v & 0xffffffff:x}u;')
         for a,v in t['mem'].items():

tools/lift.py

@@ -90,12 +90,19 @@ def _shift_count(i, base):
 # those flags as dead above and skip the real computation -> a stale value.
 # Only the fcomi/fucomi family really writes EFLAGS (the FCOMI macro all 6).
 _FCOMI = ('fcomi','fcomip','fucomi','fucomip')
+# fcmovCC is the one x87 instruction that READS EFLAGS: ST(0) = ST(i) when the
+# condition (the jcc of the same name) holds.  Its flags must count as used.
+_X87_CMOV = {'fcmovb':'b', 'fcmovnb':'ae', 'fcmove':'e', 'fcmovne':'ne',
+             'fcmovbe':'be', 'fcmovnbe':'a', 'fcmovu':'p', 'fcmovnu':'np'}
+_CC_READS = {'b':F_CF, 'ae':F_CF, 'e':F_ZF, 'ne':F_ZF, 'be':F_CF|F_ZF, 'a':F_CF|F_ZF,
+             'p':F_PF, 'np':F_PF}
 
 def _flag_defuse(i):
     if i.mnemonic in _OPAQUE:
         return 0, F_ALL
     base = i.mnemonic.split()[-1]          # "repe cmpsb" -> "cmpsb"
     if base[:1] == 'f' or X86_GRP_FPU in i.groups:
+        if base in _X87_CMOV: return 0, _CC_READS[_X87_CMOV[base]]
         return (F_ALL, 0) if base in _FCOMI else (0, 0)
     ef = getattr(i, 'eflags', 0) or 0
     d = u = 0
@@ -684,6 +691,12 @@ def imem(k):
         if m=='fsqrt':  return ["{ double _a=ST(0); ST(0)=x87_r1(_a, sqrt(_a)); }"]
         if m=='fsin':   return ["ST(0) = sin(ST(0));"]
         if m=='fcos':   return ["ST(0) = cos(ST(0));"]
+        # fsincos: x in ST(0) -> ST(1) = sin x, ST(0) = cos x (the D3DX rotation helpers)
+        if m=='fsincos': return ["FPUSH(ST(0));", "ST(1) = sin(ST(1));", "ST(0) = cos(ST(0));"]
+        if m=='fxam':    return ["X87_EXAMINE(ST(0));"]
+        if m in _X87_CMOV:
+            src = sti(len(o)-1) if o and is_st(len(o)-1) else 1
+            return [f"if ({CC[_X87_CMOV[m]]}) ST(0) = ST({src});"]
         if m=='fptan':  return ["ST(0) = tan(ST(0));","FPUSH(1.0);"]
         if m=='fpatan': return ["ST(1) = atan2(ST(1), ST(0));","FPOP();"]
         if m=='fyl2x':  return ["ST(1) = ST(1) * log2(ST(0));","FPOP();"]
@@ -818,6 +831,8 @@ def imem(k):
         if m=='bswap': return [W(0,f"__builtin_bswap32({E(0)})")]
         if m=='sahf':  return ["{ uint32_t _f=(c->eax>>8)&0xffu; c->cf=_f&1; c->pf=(_f>>2)&1; c->af=(_f>>4)&1; c->zf=(_f>>6)&1; c->sf=(_f>>7)&1; }"]
         if m=='lahf':  return ["c->eax = (c->eax & 0xffff00ffu) | ((c->sf<<7|c->zf<<6|c->af<<4|c->pf<<2|2u|c->cf)<<8);"]
+        if m in ('xlatb','xlat'):    # AL = the byte at EBX + AL (a table lookup)
+            return ["{ uint32_t _t = c->ebx + (c->eax & 0xffu); c->eax = (c->eax & 0xffffff00u) | MR8(_t); }"]
         if m=='cpuid': return ["cpuid_shim(c);"]
         if m=='rdtsc': return ["{ uint64_t _t=rdtsc_shim(); c->eax=(uint32_t)_t; c->edx=(uint32_t)(_t>>32); }"]
         if m in ('clc',): return ["c->cf=0;"]
@@ -870,6 +885,9 @@ def is_gp(k): return o[k].type==X86_OP_REG and o[k].reg in R32
         def is_mem(k): return o[k].type==X86_OP_MEM
 
         if m=='emms': return ["/* emms */"]
+        # MXCSR is kept (c->mxcsr) but not applied: SSE arithmetic rounds to nearest
+        if m=='stmxcsr': return [f"MR32{self.ea(o[0].mem)} = c->mxcsr;"]
+        if m=='ldmxcsr': return [f"c->mxcsr = MR32{self.ea(o[0].mem)};"]
         if m in ('movq','movd'):
             w = 8 if m=='movq' else 4
             T = 'uint64_t' if w==8 else 'uint32_t'