AAM is defined in APM as

AH = (AL/10d)
AL = (AL mod 10d)

However, due to the order of operations, we're incorrectly computing it as

AL = (AL mod 10d)
AH = (AL/10d) = ((originalAL mod 10d)/10d) = 0

Fix it by reordering the operations to match what's defined in APM
and avoid the unexpected dependency between the 2 operations.

Fixes: 8993572b9c16 ("x86emul: fold/eliminate some local variables")
Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 89c37fea2c..f168f3ebcf 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2511,8 +2511,8 @@ x86_emulate(
         else
         {
             generate_exception_if(!n, X86_EXC_DE);
-            _regs.al = _regs.al % n;
             _regs.ah = _regs.al / n;
+            _regs.al = _regs.al % n;
         }
         _regs.eflags &= ~(X86_EFLAGS_SF | X86_EFLAGS_ZF | X86_EFLAGS_PF);
         _regs.eflags |= !_regs.al ? X86_EFLAGS_ZF : 0;
-- 
2.55.0



-- 
Teddy Astie | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

On 24/09/2026 12:59 pm, Teddy Astie wrote:
> AAM is defined in APM as
>
> AH = (AL/10d)
> AL = (AL mod 10d)
>
> However, due to the order of operations, we're incorrectly computing it as
>
> AL = (AL mod 10d)
> AH = (AL/10d) = ((originalAL mod 10d)/10d) = 0
>
> Fix it by reordering the operations to match what's defined in APM
> and avoid the unexpected dependency between the 2 operations.
>
> Fixes: 8993572b9c16 ("x86emul: fold/eliminate some local variables")
> Signed-off-by: Teddy Astie <teddy.astie@vates.tech>

Oops.  Yes, looking at the code, it was previously:

    movzbl -0x88(%rbp),%eax
    xor    %edx,%edx
    div    %ecx
    mov    %dl,-0x88(%rbp)
    mov    %edx,%eax
    xor    %edx,%edx
    div    %ecx
    mov    %al,-0x87(%rbp)

and with this fix:

    movzbl -0x88(%rbp),%eax
    xor    %edx,%edx
    div    %ecx
    mov    %al,-0x87(%rbp)
    mov    %dl,-0x88(%rbp)

Reviewed-by: Andrew Cooper <andrew.cooper3@citix.com>