CS.RPL is not equal to the CPL in the few instructions between setting CR0.PE and reloading CS. We get this right in the common case, because writes to CR0 do not modify the CPL, but it would not be enough if an SMI comes exactly during that brief period.
So this patch fixes the CPL to come from SS.DPL instead, which requires a couple changes to make access rights correct for VM86 mode, and to override the CPL to CS.RPL during task switches (more details in patch 2). The Intel documentation mentions in a couple places that SS.DPL is indeed the current privilege level. Tested with FreeDOS (checking with info registers that it runs in real vs. VM86 mode depending on the chosen boot option), kvm-unit-tests and runcom.c. v1->v2: fix user-mode emulation Paolo Bonzini (3): target-i386: fix segment flags for SMM, user-mode emulation and VM86 mode target-i386: rework CPL checks during task switch, preparing for next patch target-i386: get CPL from SS.DPL bsd-user/main.c | 2 +- linux-user/main.c | 2 +- target-i386/cpu.h | 8 +++----- target-i386/gdbstub.c | 4 +++- target-i386/kvm.c | 2 +- target-i386/machine.c | 8 ++++++++ target-i386/seg_helper.c | 34 +++++++++++++++++----------------- target-i386/smm_helper.c | 24 ++++++++++++++++++------ 8 files changed, 52 insertions(+), 32 deletions(-) -- 1.8.3.1
