From: Paolo Bonzini Date: Wed, 2 Mar 2016 15:04:38 +0000 (+0100) Subject: target-i386: Fix addr16 prefix X-Git-Tag: TizenStudio_2.0_p2.4~27^2~6^2~8^2~121^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e2e02a820741ec4d96b8f313b06a2a7ed5e94fbd;p=sdk%2Femulator%2Fqemu.git target-i386: Fix addr16 prefix While ADDSEG will only be false in 16-bit mode for LEA, it can be false even in other cases when 16-bit addresses are obtained via the 67h prefix in 32-bit mode. In this case, gen_lea_v_seg forgets to add a nonzero FS or GS base if CS/DS/ES/SS are all zero. This case is pretty rare but happens when booting Windows 95/98, and this patch fixes it. The bug is visible since commit d6a291498, but it was introduced together with gen_lea_v_seg and it probably could be reproduced with a "addr16 gs movsb" instruction as early as in commit ca2f29f555805d07fb0b9ebfbbfc4e3656530977. Reported-by: Hervé Poussineau Tested-by: Hervé Poussineau Signed-off-by: Paolo Bonzini Message-Id: <1456931078-21635-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Richard Henderson --- diff --git a/target-i386/translate.c b/target-i386/translate.c index b73c237..0b67165 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -466,15 +466,15 @@ static void gen_lea_v_seg(DisasContext *s, TCGMemOp aflag, TCGv a0, break; case MO_16: /* 16 bit address */ - if (ovr_seg < 0) { - ovr_seg = def_seg; - } tcg_gen_ext16u_tl(cpu_A0, a0); - /* ADDSEG will only be false in 16-bit mode for LEA. */ - if (!s->addseg) { - return; - } a0 = cpu_A0; + if (ovr_seg < 0) { + if (s->addseg) { + ovr_seg = def_seg; + } else { + return; + } + } break; default: tcg_abort();