How to multiply an SSE float with a hardcoded value using MULSS?

Question

I have the following line of code in a game:

movss xmm0,[eax+000000F0]

It basically loads the float speed of the current speed category into the XMM0 register. I already made a jump to an empty code section to get some more space, because I now want to multiply this speed by a hardcoded value of 2 after it was loaded. Sadly, easy-thinking like this doesn't work:

movss xmm0,[eax+000000F0]
mulss xmm0,2

I can't simply multiply an XMM register with an integer or float immediate. I read that I can only multiply with another XMM register. But then again I can't push and pop an existing XMM register to the stack to abuse it for that operation temporarily.

How would I create such a simple multiplication operation?

Answer 1

Although you indeed cannot use mulss with an immediate value like you've pointed out, you are allowed to pass an 32bit offset as mulss's second operand:

Multiplies the low single-precision floating-point value from the source operand (second operand) by the low single-precision floating-point value in the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order double-words of the destination operand remain unchanged.

You could then just point to any offset you control, if code is not relocated. If it is, you could simply use 'lea' if in 64bit mode or do the call $+5 / pop trick in x86.

I'll assume x86 because it makes it a bit more complicated. The patch should look something like the following (this wasn't tested):

    push edx
    call next
next:
    pop edx
    movss xmm0,[eax+000000F0]
    mulss xmm0,[edx+float-next]
    pop edx
    <return to previous location>

float:
    <float as 32bit data>

There might be better solutions, but nothing pops at me.