[Qemu-devel] [PATCH v2 0/3] target-i386: fix CPL computation

[Paolo Bonzini]

CS.RPL is not equal to the CPL in the few instructions between
setting CR0.PE and reloading CS.  We get this right in the common
case, because writes to CR0 do not modify the CPL, but it would
not be enough if an SMI comes exactly during that brief period.

So this patch fixes the CPL to come from SS.DPL instead, which
requires a couple changes to make access rights correct for VM86
mode, and to override the CPL to CS.RPL during task switches (more
details in patch 2).  The Intel documentation mentions in a couple
places that SS.DPL is indeed the current privilege level.

Tested with FreeDOS (checking with info registers that it runs
in real vs. VM86 mode depending on the chosen boot option),
kvm-unit-tests and runcom.c.

v1->v2: fix user-mode emulation

Paolo Bonzini (3):
  target-i386: fix segment flags for SMM, user-mode emulation and VM86 mode
  target-i386: rework CPL checks during task switch, preparing for next patch
  target-i386: get CPL from SS.DPL

 bsd-user/main.c          |  2 +-
 linux-user/main.c        |  2 +-
 target-i386/cpu.h        |  8 +++-----
 target-i386/gdbstub.c    |  4 +++-
 target-i386/kvm.c        |  2 +-
 target-i386/machine.c    |  8 ++++++++
 target-i386/seg_helper.c | 34 +++++++++++++++++-----------------
 target-i386/smm_helper.c | 24 ++++++++++++++++++------
 8 files changed, 52 insertions(+), 32 deletions(-)

-- 
1.8.3.1