target/i386: Fix FXCH to unconditionally clear C1

[PATCH] target/i386: Fix FXCH to unconditionally clear C1

Simon Scherer posted 1 patch 3 weeks, 3 days ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260902085424.148650-1-scherer.simon89@gmail.com

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <richard.henderson@linaro.org>

target/i386/tcg/fpu_helper.c | 3 +++
1 file changed, 3 insertions(+)

Expand all Fold all

[PATCH] target/i386: Fix FXCH to unconditionally clear C1

Posted by Simon Scherer 3 weeks, 3 days ago

Per the SDM, FXCH unconditionally clears the FPU status word's C1
flag. QEMU's helper_fxchg_ST0_STN swaps ST(0) and ST(i) but never
touches fpus, so C1 is left untouched from whatever prior instruction
set it.

This patch clears C1 after the exchange matching the SDM.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4399
Signed-off-by: Simon Scherer <scherer.simon89@gmail.com>
---
See also my earlier patch (20260828082235.128360-1-scherer.simon89@gmail.com)
to unconditionally clear C1 for the x87 compare instructions.

 target/i386/tcg/fpu_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index b812125efa..32af8b79f4 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -519,6 +519,9 @@ void helper_fxchg_ST0_STN(CPUX86State *env, int st_index)
     tmp = ST(st_index);
     ST(st_index) = ST0;
     ST0 = tmp;
+
+    /* C1 is unconditionally cleared to 0 */
+    env->fpus &= ~0x0200;
 }
 
 /* FPU operations */
-- 
2.53.0

Re: [PATCH] target/i386: Fix FXCH to unconditionally clear C1

Posted by Michael Tokarev 2 weeks, 2 days ago

On 9/2/26 11:54, Simon Scherer wrote:
> Per the SDM, FXCH unconditionally clears the FPU status word's C1
> flag. QEMU's helper_fxchg_ST0_STN swaps ST(0) and ST(i) but never
> touches fpus, so C1 is left untouched from whatever prior instruction
> set it.
> 
> This patch clears C1 after the exchange matching the SDM.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4399
> Signed-off-by: Simon Scherer <scherer.simon89@gmail.com>
> ---
> See also my earlier patch (20260828082235.128360-1-scherer.simon89@gmail.com)
> to unconditionally clear C1 for the x87 compare instructions.

Hi!

Is this a qemu-stable material?

Thanks,

/mjt

>   target/i386/tcg/fpu_helper.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
> index b812125efa..32af8b79f4 100644
> --- a/target/i386/tcg/fpu_helper.c
> +++ b/target/i386/tcg/fpu_helper.c
> @@ -519,6 +519,9 @@ void helper_fxchg_ST0_STN(CPUX86State *env, int st_index)
>       tmp = ST(st_index);
>       ST(st_index) = ST0;
>       ST0 = tmp;
> +
> +    /* C1 is unconditionally cleared to 0 */
> +    env->fpus &= ~0x0200;
>   }
>   
>   /* FPU operations */