CS.RPL is not equal to the CPL in the few instructions between setting CR0.PE and reloading CS. We get this right in the common case, because writes to CR0 do not modify the CPL, but it would not be enough if an SMI comes exactly during that brief period.
So this patch fixes the CPL to come from SS.DPL instead, which requires a couple changes to make access rights correct for VM86 mode, and to override the CPL to CS.RPL during task switches (more details in patch 2). Tested with FreeDOS and kvm-unit-tests. Paolo Bonzini (3): target-i386: fix segment flags for SMM and VM86 mode target-i386: prepare CPL checks for next patch target-i386: get CPL from SS.DPL target-i386/cpu.h | 8 +++----- target-i386/kvm.c | 2 +- target-i386/machine.c | 8 ++++++++ target-i386/seg_helper.c | 27 ++++++++++++--------------- target-i386/smm_helper.c | 24 ++++++++++++++++++------ 5 files changed, 42 insertions(+), 27 deletions(-) -- 1.8.3.1
