* [Qemu-devel] [RFC] [PATCH] TSS ljmp issues
@ 2006-06-19 18:29 malc
0 siblings, 0 replies; only message in thread
From: malc @ 2006-06-19 18:29 UTC (permalink / raw)
To: qemu-devel
[-- Attachment #1: Type: TEXT/PLAIN, Size: 353 bytes --]
QEMU does not correctly handle jumps to TSS segments, the code in
switch_tss loads new eflags, but cc_op is never set to CC_OP_EFLAGS.
The problem manifests itself when trying to run DJGPP binaries
compressed with UPX. It goes something like this:
sub esi, 0FFFFFFFCh
adc ebx, ebx
loc_169: ; CODE XREF: start+1B
--
mailto:malc@pulsesoft.com
[-- Attachment #2: Type: TEXT/PLAIN, Size: 658 bytes --]
Index: target-i386/helper.c
===================================================================
RCS file: /cvsroot/qemu/qemu/target-i386/helper.c,v
retrieving revision 1.65
diff -u -r1.65 helper.c
--- target-i386/helper.c 3 May 2006 19:17:26 -0000 1.65
+++ target-i386/helper.c 19 Jun 2006 18:19:12 -0000
@@ -1674,6 +1674,7 @@
raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
next_eip = env->eip + next_eip_addend;
switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
+ CC_OP = CC_OP_EFLAGS;
break;
case 4: /* 286 call gate */
case 12: /* 386 call gate */
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2006-06-19 18:29 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-06-19 18:29 [Qemu-devel] [RFC] [PATCH] TSS ljmp issues malc
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).