diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2024-06-06 10:53:19 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-06-08 10:33:38 +0200 |
| commit | 3973615e7fbaeef1deeaa067577e373781ced70a (patch) | |
| tree | c140075eb24ddabee6eafe91975e40cc3d633a17 | |
| parent | f1b8613da380af8931e34dfb4dd0a6cca392d43b (diff) | |
| download | qemu-3973615e7fbaeef1deeaa067577e373781ced70a.zip qemu-3973615e7fbaeef1deeaa067577e373781ced70a.tar.gz qemu-3973615e7fbaeef1deeaa067577e373781ced70a.tar.bz2 | |
target/i386: fix size of EBP writeback in gen_enter()
The calculation of FrameTemp is done using the size indicated by mo_pushpop()
before being written back to EBP, but the final writeback to EBP is done using
the size indicated by mo_stacksize().
In the case where mo_pushpop() is MO_32 and mo_stacksize() is MO_16 then the
final writeback to EBP is done using MO_16 which can leave junk in the top
16-bits of EBP after executing ENTER.
Change the writeback of EBP to use the same size indicated by mo_pushpop() to
ensure that the full value is written back.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198
Message-ID: <20240606095319.229650-5-mark.cave-ayland@ilande.co.uk>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/tcg/translate.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 2b6f67b..fcba9c1 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2138,7 +2138,7 @@ static void gen_enter(DisasContext *s, int esp_addend, int level) } /* Copy the FrameTemp value to EBP. */ - gen_op_mov_reg_v(s, a_ot, R_EBP, s->T1); + gen_op_mov_reg_v(s, d_ot, R_EBP, s->T1); /* Compute the final value of ESP. */ tcg_gen_subi_tl(s->T1, s->T1, esp_addend + size * level); |