diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2014-05-14 10:38:18 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2014-05-21 18:02:08 +0200 |
| commit | 7125c937c97d9ec4a41b3cb6d1b3e805ec53e255 (patch) | |
| tree | 9708833c2a12eecd0a52c9c85a0853d0a54784a5 /target-i386/kvm.c | |
| parent | d3b5491897456739c6dc21c604ef8bc28e294bfc (diff) | |
target-i386: get CPL from SS.DPL
CS.RPL is not equal to the CPL in the few instructions between
setting CR0.PE and reloading CS. We get this right in the common
case, because writes to CR0 do not modify the CPL, but it would
not be enough if an SMI comes exactly during that brief period.
Were this to happen, the RSM instruction would erroneously set
CPL to the low two bits of the real-mode selector; and if they are
not 00, the next instruction fetch cannot access the code segment
and causes a triple fault.
However, SS.DPL *is* always equal to the CPL. In real processors
(AMD only) there is a weird case of SYSRET setting SS.DPL=SS.RPL
from the STAR register while forcing CPL=3, but we do not emulate
that.
Tested-by: Kevin O'Connor <kevin@koconnor.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'target-i386/kvm.c')
| -rw-r--r-- | target-i386/kvm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target-i386/kvm.c b/target-i386/kvm.c index 0d894ef4aa..3931d4c340 100644 --- a/target-i386/kvm.c +++ b/target-i386/kvm.c @@ -1430,7 +1430,7 @@ static int kvm_get_sregs(X86CPU *cpu) HF_OSFXSR_MASK | HF_LMA_MASK | HF_CS32_MASK | \ HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK) - hflags = (env->segs[R_CS].flags >> DESC_DPL_SHIFT) & HF_CPL_MASK; + hflags = (env->segs[R_SS].flags >> DESC_DPL_SHIFT) & HF_CPL_MASK; hflags |= (env->cr[0] & CR0_PE_MASK) << (HF_PE_SHIFT - CR0_PE_SHIFT); hflags |= (env->cr[0] << (HF_MP_SHIFT - CR0_MP_SHIFT)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK); |