From: Paolo Bonzini <[email protected]> The stack can be 32-bit even in real mode, and in this case the stack pointer must be updated in its entirety rather than just the bottom 16 bits. The same is true of real mode IRET, for which there was even a comment suggesting the right thing to do.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1506 Signed-off-by: Paolo Bonzini <[email protected]> (cherry picked from commit 106d766c9d5b549bc9780d2d2c519aa2bbebc89a) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c index f49fe851cd..de49d21756 100644 --- a/target/i386/tcg/seg_helper.c +++ b/target/i386/tcg/seg_helper.c @@ -1160,7 +1160,7 @@ static void do_interrupt_real(CPUX86State *env, int intno, int is_int, sa.env = env; sa.ra = 0; sa.sp = env->regs[R_ESP]; - sa.sp_mask = 0xffff; + sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); sa.ss_base = env->segs[R_SS].base; sa.mmu_index = x86_mmu_index_pl(env, 0); @@ -1960,7 +1960,7 @@ void helper_iret_real(CPUX86State *env, int shift) sa.env = env; sa.ra = GETPC(); sa.mmu_index = x86_mmu_index_pl(env, 0); - sa.sp_mask = 0xffff; /* XXXX: use SS segment size? */ + sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); sa.sp = env->regs[R_ESP]; sa.ss_base = env->segs[R_SS].base; -- 2.47.3
