Re: [Qemu-devel] IMUL eflags update

[Charlie Gordon]

Hi fellow,

There are multiple forms of the IMUL instruction.  I suspect they do not
behave identically with regard to (unspecified) flags update.
Extensive testing on different CPUs (486, pentiums, AMDs, Cyrix...) should
tell you what is the precise behaviour.  Common patterns should emerge and
should be emulated as compatible OSes might rely on them.  Testing on a
TransMeta chip would be interesting too!
Bochs approach seems quite pragmatic, do they document or can they be
questioned as to why they decided for flags preservation.

Charlie Gordon.

----- Original Message -----
From: "Fabrice Bellard" <address@hidden>
To: <address@hidden>
Sent: Monday, December 01, 2003 12:15 AM
Subject: [Qemu-devel] IMUL eflags update


> Hi,
>
> My next patches will allow Windows 3.11 to be usable in QEMU. While
> fixing a bug related to the cursor drawing, I found an interesting
> problem related to x86 processors:
>
> Which x86 condition codes get updated by the mul/imul instructions ?
>
> The intel specs says that only CF and OF are updated. The other
> condition codes are said to be undefined. The problem is that the
> Windows 3.11 cursor drawing code relies on the "SF" flag after imul
> (here is the offending code disassembled with Bochs):
>
> 0002866d: (                    ): mov AX, DS:[BX+0169]      ; 8b876901
> 00028671: (                    ): mov CX, DS:[BP+0165]      ; 3e8b8e6501
> 00028676: (                    ): sub AX, CX                ; 2bc1
> 00028678: (                    ): mov DL, AL                ; 8ad0
> 0002867a: (                    ): imul AX, AX, 05           ; 6bc005
> 0002867d: (                    ): jl 8685                   ; 7c06
> 0002867f: (                    ): add DI, AX                ; 03f8
> 00028681: (                    ): neg DL                    ; f6da
> 00028683: (                    ): jmp 8687                  ; eb02
> 00028685: (                    ): sub SI, AX                ; 2bf0
> 00028687: (                    ): add DL, 20                ; 80c220
>
> The solution used by Bochs to fix the problem is to say that imul
> modifies only OF and CF. The other flas are not modified.
>
> QEMU currently zeros all the other flags in order to have a faster flag
> update.
>
> By doing tests on a Pentium 4 processor, it seems that at least SF is
> set according to the result of the IMUL operation.
>
> So what is the best behavior to implement ? Bochs one or P4 one ?
>
> Fabrice.
>
>
>
> _______________________________________________
> Qemu-devel mailing list
> address@hidden
> http://mail.nongnu.org/mailman/listinfo/qemu-devel
>