[Qemu-devel] IMUL eflags update

[Fabrice Bellard]

Hi,

My next patches will allow Windows 3.11 to be usable in QEMU. While 
fixing a bug related to the cursor drawing, I found an interesting 
problem related to x86 processors:

Which x86 condition codes get updated by the mul/imul instructions ?

The intel specs says that only CF and OF are updated. The other 
condition codes are said to be undefined. The problem is that the 
Windows 3.11 cursor drawing code relies on the "SF" flag after imul 
(here is the offending code disassembled with Bochs):

0002866d: (                    ): mov AX, DS:[BX+0169]      ; 8b876901
00028671: (                    ): mov CX, DS:[BP+0165]      ; 3e8b8e6501
00028676: (                    ): sub AX, CX                ; 2bc1
00028678: (                    ): mov DL, AL                ; 8ad0
0002867a: (                    ): imul AX, AX, 05           ; 6bc005
0002867d: (                    ): jl 8685                   ; 7c06
0002867f: (                    ): add DI, AX                ; 03f8
00028681: (                    ): neg DL                    ; f6da
00028683: (                    ): jmp 8687                  ; eb02
00028685: (                    ): sub SI, AX                ; 2bf0
00028687: (                    ): add DL, 20                ; 80c220

The solution used by Bochs to fix the problem is to say that imul 
modifies only OF and CF. The other flas are not modified.

QEMU currently zeros all the other flags in order to have a faster flag 
update.

By doing tests on a Pentium 4 processor, it seems that at least SF is 
set according to the result of the IMUL operation.

So what is the best behavior to implement ? Bochs one or P4 one ?

Fabrice.