x86仿真模式

ppmyonly

/*
* Setup and switch to ESPFIX stack
*
* We're returning to userspace with a 16 bit stack. The CPU will not
* restore the high word of ESP for us on executing iret... This is an
* "official" bug of all the x86-compatible CPUs, which we can work
* around to make dosemu and wine happy. We do this by preloading the
* high word of ESP with the high word of the userspace ESP while
* compensating for the offset by changing to the ESPFIX segment with
* a base address that matches for the difference.
*/
#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS*
        mov %esp, %edx                        /* load kernel esp */
        mov PT_OLDESP(%esp), %eax        /* load userspace esp */
        mov %dx, %ax                        /* eax: new kernel esp */
        sub %eax, %edx                        /* offset (low word is 0) */
        shr $16, %edx
        mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
        mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
        pushl_cfi $__ESPFIX_SS
        pushl_cfi %eax                        /* new kernel esp */
        /* Disable interrupts, but do not irqtrace this section: we
         * will soon execute iret and the tracer was already set to
         * the irqstate after the iret */
        DISABLE_INTERRUPTS(CLBR_EAX)
        lss (%esp), %esp                /* switch to espfix segment */
        CFI_ADJUST_CFA_OFFSET -8
        jmp restore_nocheck
对以上代码有些疑问：
       修正后的基地址是：内核esp高16位 减 用户esp高16位，
       lss加载的esp是：用户esp高16位：内核esp低16位，
      谁能解释下为什么要这样？
      iret指令对这些值有什么影响？