QEMU does not correctly handle jumps to TSS segments, the code in
switch_tss loads new eflags, but cc_op is never set to CC_OP_EFLAGS.
The problem manifests itself when trying to run DJGPP binaries
compressed with UPX. It goes something like this:
sub esi, 0FFFFFFFCh
adc ebx, ebx
loc_169: ; CODE XREF: start+1B
--
mailto:[EMAIL PROTECTED]Index: target-i386/helper.c
===================================================================
RCS file: /cvsroot/qemu/qemu/target-i386/helper.c,v
retrieving revision 1.65
diff -u -r1.65 helper.c
--- target-i386/helper.c 3 May 2006 19:17:26 -0000 1.65
+++ target-i386/helper.c 19 Jun 2006 18:19:12 -0000
@@ -1674,6 +1674,7 @@
raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
next_eip = env->eip + next_eip_addend;
switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
+ CC_OP = CC_OP_EFLAGS;
break;
case 4: /* 286 call gate */
case 12: /* 386 call gate */
_______________________________________________
Qemu-devel mailing list
Qemu-devel@nongnu.org
http://lists.nongnu.org/mailman/listinfo/qemu-devel
