Re: [Qemu-devel] [PATCH 3/3] target-i386: get CPL from SS.DPL

[Paolo Bonzini <pbonzini@redhat.com>]

Il 15/05/2014 20:38, Kevin O'Connor ha scritto:
> On Thu, May 15, 2014 at 06:56:56PM +0200, Paolo Bonzini wrote:
>> CS.RPL is not equal to the CPL in the few instructions between
>> setting CR0.PE and reloading CS.  We get this right in the common
>> case, because writes to CR0 do not modify the CPL, but it would
>> not be enough if an SMI comes exactly during that brief period.
>> Were this to happen, the RSM instruction would erroneously set
>> CPL to the low two bits of the real-mode selector; and if they are
>> not 00, the next instruction fetch cannot access the code segment
>> and causes a triple fault.
>>
>> However, SS.DPL *is* always equal to the CPL (except during task switches
>> as noted in the previous patch).  In real processors (AMD only) there
>> is a weird case of SYSRET setting SS.DPL=SS.RPL from the STAR register
>> while forcing CPL=3, but we do not emulate that.
>
> It looks to me like there could be a couple of places in the code
> where cpu_x86_load_seg_cache(R_CS) is called, but
> cpu_x86_load_seg_cache(R_SS) may not be.  In particular,
> helper_ret_protected() and cpu_x86_load_seg_cache_sipi().  Are these
> still okay?

Yes, helper_ret_protected() skips the SS load only if rpl == cpl (so if 
CS.RPL == SS.DPL, and the invariant is respected). 
cpu_x86_load_seg_cache_sipi() runs in real mode only.

Paolo