Re: [Qemu-devel] [PATCH] target-i386: fix iret emulation correctness

[Paolo Bonzini]

On 07/06/2016 10:07, poletaev wrote:
> diff --git a/target-i386/translate.c b/target-i386/translate.c
> index f010022..c409baf 100644
> --- a/target-i386/translate.c
> +++ b/target-i386/translate.c
> @@ -6319,6 +6319,7 @@ static target_ulong disas_insn(CPUX86State *env,
> DisasContext *s,
>              set_cc_op(s, CC_OP_EFLAGS);
>          } else if (s->vm86) {
>              if (s->iopl != 3) {
> +                gen_helper_reset_nmi_blocking(cpu_env);
>                  gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);

I am afraid that the solution is more complicated.  The exception will
be handled before the NMI, while the opposite should be done according
to the manual.

So, first, you need to move HF2_NMI_MASK from hflags2 to hflags, so that
different NMI masking states cause the guest code to be retranslated.
Second, an IRET with HF_NMI_MASK set can be translated to _only_ the
reset of NMI mask followed by end of basic block.  An IRET without
HF_NMI_MASK instead can be translated the same way as now.

Paolo

> 
>              } else {
> 
>                  gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1));
>