Re: [Qemu-devel] [PATCH] target-i386: fix iret emulation correctness

[Paolo Bonzini]

On 07/06/2016 14:07, poletaev wrote:
>> Second, an IRET with HF_NMI_MASK set can be translated to _only_ the 
>> reset of NMI mask followed by end of basic block.  An IRET without 
>> HF_NMI_MASK instead can be translated the same way as now.
> 
> I want to make it like this, but it seems to me it can lead to zero tb size
> and introduce bad side effect. What I do wrong?
> 
> case 0xcf: /* iret */
>     gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET);
>     if (!s->pe) {
>         /* real mode */
>         gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1));
>         set_cc_op(s, CC_OP_EFLAGS);
>     } else if (s->vm86) {
>         if (s->iopl != 3) {
>             if (s->flags & HF_NMI_MASK) {
>                 gen_reset_hflag(s, HF_NMI_MASK);
>                 s->pc = pc_start;
>                 gen_jmp_im(pc_start - s->cs_base);
>             } else {
>                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
>             }
>         } else {
>             gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1));
>             set_cc_op(s, CC_OP_EFLAGS);
>         }
>     } else {
>         gen_helper_iret_protected(cpu_env, tcg_const_i32(dflag - 1),
>                                   tcg_const_i32(s->pc - s->cs_base));
>         set_cc_op(s, CC_OP_EFLAGS);
>     }
>     gen_eob(s);
>     break;

I think it's okay to make it count as a one instruction tb, just like a
tb with a "jmp ." instruction.

Thanks,

Paolo