[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 003/113] target/i386: seg_helper: Correct segement selector nullif
From: |
Paolo Bonzini |
Subject: |
[PULL 003/113] target/i386: seg_helper: Correct segement selector nullification in the RET/IRET helper |
Date: |
Wed, 2 Dec 2020 03:06:59 -0500 |
From: Bin Meng <bin.meng@windriver.com>
Per the SDM, when returning to outer privilege level, for segment
registers (ES, FS, GS, and DS) if the check fails, the segment
selector becomes null, but QEMU clears the base/limit/flags as well
as nullifying the segment selector, which should be a spec violation.
Real hardware seems to be compliant with the spec, at least on one
Coffee Lake board I tested.
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <1605261378-77971-1-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/seg_helper.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/target/i386/seg_helper.c b/target/i386/seg_helper.c
index 09b6554660..e6ffa1f018 100644
--- a/target/i386/seg_helper.c
+++ b/target/i386/seg_helper.c
@@ -2108,7 +2108,10 @@ static inline void validate_seg(CPUX86State *env, int
seg_reg, int cpl)
if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
/* data or non conforming code segment */
if (dpl < cpl) {
- cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
+ cpu_x86_load_seg_cache(env, seg_reg, 0,
+ env->segs[seg_reg].base,
+ env->segs[seg_reg].limit,
+ env->segs[seg_reg].flags & ~DESC_P_MASK);
}
}
}
--
2.26.2
- [PULL 000/113] First batch of misc (i386, kernel-doc, memory, vl.c) changes for QEMU 6.0, Paolo Bonzini, 2020/12/02
- [PULL 003/113] target/i386: seg_helper: Correct segement selector nullification in the RET/IRET helper,
Paolo Bonzini <=
- [PULL 002/113] target/i386: Support up to 32768 CPUs without IRQ remapping, Paolo Bonzini, 2020/12/02
- [PULL 005/113] docs/devel/loads-stores: Add regexp for DMA functions, Paolo Bonzini, 2020/12/02
- [PULL 008/113] dma: Let dma_memory_set() propagate MemTxResult, Paolo Bonzini, 2020/12/02
- [PULL 001/113] target/i386: fix operand order for PDEP and PEXT, Paolo Bonzini, 2020/12/02
- [PULL 009/113] dma: Let dma_memory_rw() propagate MemTxResult, Paolo Bonzini, 2020/12/02
- [PULL 004/113] WHPX: support for the kernel-irqchip on/off, Paolo Bonzini, 2020/12/02
- [PULL 007/113] dma: Document address_space_map/address_space_unmap() prototypes, Paolo Bonzini, 2020/12/02
- [PULL 013/113] pci: Let pci_dma_read() propagate MemTxResult, Paolo Bonzini, 2020/12/02
- [PULL 014/113] pci: Let pci_dma_write() propagate MemTxResult, Paolo Bonzini, 2020/12/02
- [PULL 006/113] qom: eliminate identical functions, Paolo Bonzini, 2020/12/02