[PATCH] target/i386: Fix FXCH to unconditionally clear C1

[PATCH] target/i386: Fix FXCH to unconditionally clear C1

[Simon Scherer]

Per the SDM, FXCH unconditionally clears the FPU status word's C1
flag. QEMU's helper_fxchg_ST0_STN swaps ST(0) and ST(i) but never
touches fpus, so C1 is left untouched from whatever prior instruction
set it.

This patch clears C1 after the exchange matching the SDM.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4399
Signed-off-by: Simon Scherer <scherer.simon89@gmail.com>
---
See also my earlier patch (20260828082235.128360-1-scherer.simon89@gmail.com)
to unconditionally clear C1 for the x87 compare instructions.

 target/i386/tcg/fpu_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index b812125efa..32af8b79f4 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -519,6 +519,9 @@ void helper_fxchg_ST0_STN(CPUX86State *env, int st_index)
     tmp = ST(st_index);
     ST(st_index) = ST0;
     ST0 = tmp;
+
+    /* C1 is unconditionally cleared to 0 */
+    env->fpus &= ~0x0200;
 }
 
 /* FPU operations */
-- 
2.53.0

Re: [PATCH] target/i386: Fix FXCH to unconditionally clear C1

[Michael Tokarev]

On 9/2/26 11:54, Simon Scherer wrote:
> Per the SDM, FXCH unconditionally clears the FPU status word's C1
> flag. QEMU's helper_fxchg_ST0_STN swaps ST(0) and ST(i) but never
> touches fpus, so C1 is left untouched from whatever prior instruction
> set it.
> 
> This patch clears C1 after the exchange matching the SDM.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4399
> Signed-off-by: Simon Scherer <scherer.simon89@gmail.com>
> ---
> See also my earlier patch (20260828082235.128360-1-scherer.simon89@gmail.com)
> to unconditionally clear C1 for the x87 compare instructions.

Hi!

Is this a qemu-stable material?

Thanks,

/mjt

>   target/i386/tcg/fpu_helper.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
> index b812125efa..32af8b79f4 100644
> --- a/target/i386/tcg/fpu_helper.c
> +++ b/target/i386/tcg/fpu_helper.c
> @@ -519,6 +519,9 @@ void helper_fxchg_ST0_STN(CPUX86State *env, int st_index)
>       tmp = ST(st_index);
>       ST(st_index) = ST0;
>       ST0 = tmp;
> +
> +    /* C1 is unconditionally cleared to 0 */
> +    env->fpus &= ~0x0200;
>   }
>   
>   /* FPU operations */