## Host environment - Operating system: Linux - OS/kernel version: Linux simon-macbookpro 6.19.11+ #1 SMP PREEMPT_DYNAMIC Wed Apr 8 12:57:43 CEST 2026 aarch64 GNU/Linux - Architecture: ARM - QEMU flavor: qemu-x86_64 - QEMU version: qemu-x86_64 master branch (commit 9f4d05a21f1d3a01c136979f4b60b7b02c60e821) ## Emulated/Virtualized environment - Operating system: Linux - Architecture: x86 ## Description of problem Per the Intel Manual (Vol. 3, 15.2 THE MMX STATE AND MMX REGISTER ALIASING): "When an MMX instruction writes a value into an MMX register, at the same time, bits 64 through 79 of the corresponding floating-point register are set to all 1s." Under `qemu-x86_64`, MMX register writes leave bits 64–79 of the aliased register untouched instead of forcing them to all 1s. If those bits happened to be 0 before the MMX instruction executed (e.g. after `finit` or a prior `fldz`), they remain 0 afterward. Any subsequent x87 instruction (e.g. `fucomi`/`fucomip`) will observe a spurious finite value instead of the NaN encoding real hardware guarantees. This can silently change comparison results and condition flags. ## Steps to reproduce Tested against multiple MMX instructions (`pxor`, `pcmpeqd`, `paddb`, `psubb`). 1. Build the following C program: ```c #include <stdio.h> #include <stdint.h> #include <string.h> #define TEST_MMX_OP(label, asmop) do { \ unsigned char st0[10]; \ memset(st0, 0, sizeof(st0)); \ __asm__ __volatile__( \ "finit\n\t" \ "fldz\n\t" "fldz\n\t" "fldz\n\t" "fldz\n\t" \ "fldz\n\t" "fldz\n\t" "fldz\n\t" "fldz\n\t" \ asmop "\n\t" \ "fstpt %0\n\t" \ : "=m"(st0) : : "st" \ ); \ uint16_t sign_exp = st0[8] | ((uint16_t)st0[9] << 8); \ printf("%-10s sign+exponent field = 0x%04x\n", label, sign_exp); \ } while (0) int main(void) { TEST_MMX_OP("pxor", "pxor %%mm0, %%mm0"); TEST_MMX_OP("pcmpeqd", "pcmpeqd %%mm0, %%mm0"); TEST_MMX_OP("paddb", "paddb %%mm0, %%mm0"); TEST_MMX_OP("psubb", "psubb %%mm0, %%mm0"); return 0; } ``` 2. Run under `qemu-x86_64`. Observered output: ``` pxor sign+exponent field = 0x0000 pcmpeqd sign+exponent field = 0x0000 paddb sign+exponent field = 0x0000 psubb sign+exponent field = 0x0000 ``` 3. Run `natively`. Observered output: ``` pxor sign+exponent field = 0xffff pcmpeqd sign+exponent field = 0xffff paddb sign+exponent field = 0xffff psubb sign+exponent field = 0xffff ```