[Qemu-devel] restoring eflags after iret on x86

[Qemu-devel] restoring eflags after iret on x86

[Cohn, Robert S]

I am working with 0.9.1 sources and have seen a problem with restoring
eflags during an iret.

helper_ret_protected Does this:
    if (is_iret) {
        /* NOTE: 'cpl' is the _old_ CPL */
        eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
        if (cpl == 0)
            eflags_mask |= IOPL_MASK;
        iopl = (env->eflags >> IOPL_SHIFT) & 3;
        if (cpl <= iopl)
            eflags_mask |= IF_MASK;
        if (shift == 0)
            eflags_mask &= 0xffff;
        load_eflags(new_eflags, eflags_mask);
  }
  
My understanding is that it also needs to do:
env->cc_op = CC_OP_EFLAGS
  
Or else it will continue to use the old value of cc_op, which will not
be consistent with the value that was just stored into cc_src.
  
I looked at the trunk on svn and it appears to have the same problem. It
is strange that iret is broken in this way and no one else is seeing the
problem. Am I missing something?
  
Robert
  

Re: [Qemu-devel] restoring eflags after iret on x86

[malc]

On Sun, 7 Sep 2008, Cohn, Robert S wrote:

> I am working with 0.9.1 sources and have seen a problem with restoring
> eflags during an iret.
>
> helper_ret_protected Does this:
>    if (is_iret) {
>        /* NOTE: 'cpl' is the _old_ CPL */
>        eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
>        if (cpl == 0)
>            eflags_mask |= IOPL_MASK;
>        iopl = (env->eflags >> IOPL_SHIFT) & 3;
>        if (cpl <= iopl)
>            eflags_mask |= IF_MASK;
>        if (shift == 0)
>            eflags_mask &= 0xffff;
>        load_eflags(new_eflags, eflags_mask);
>  }
>
> My understanding is that it also needs to do:
> env->cc_op = CC_OP_EFLAGS
>
> Or else it will continue to use the old value of cc_op, which will not
> be consistent with the value that was just stored into cc_src.
>
> I looked at the trunk on svn and it appears to have the same problem. It
> is strange that iret is broken in this way and no one else is seeing the
> problem. Am I missing something?

Yes you do. Look at target-i386/translate.c after emiting the tcg
helper call to iret helper it sets s->cc_op to CC_OP_EFLAGS and
calls gen_eob which propgates this to env cc_op.

-- 
mailto:av1474@comtv.ru