| commit | e95e9b88ba5f4a6c17f4d0c3a3a6bf3f648bb328 | |
| author | Wu Xiang <willx8@gmail.com> | |
| Wed, 21 Jun 2017 14:21:56 +0000 (21 22:21 +0800) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Tue, 4 Jul 2017 12:30:03 +0000 (4 14:30 +0200) | ||
| tree | 75c85c71f91ab69549f38273c72f531ee728fe96 | treesnapshot (tar.gz zip) |
| parent | 96d06835dc40007673cdfab6322e9042c4077113 | commitdiff |
target/i386: fix interrupt CPL error when using ist in x86-64
In do_interrupt64(), when interrupt stack table(ist) is enabled
and the the target code segment is conforming(e2 & DESC_C_MASK), the
old implementation always set new CPL to 0, and SS.RPL to 0.
This is incorrect for when CPL3 code access a CPL0 conforming code
segment, the CPL should remain unchanged. Otherwise higher privileged
code can be compromised.
The patch fix this for always set dpl = cpl when the target code segment
is conforming, and modify the last parameter `flags`, which contains
correct new CPL, in cpu_x86_load_seg_cache().
Signed-off-by: Wu Xiang <willx8@gmail.com>
Message-Id: <20170621142152.GA18094@wxdeubuntu.ipads-lab.se.sjtu.edu.cn>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
In do_interrupt64(), when interrupt stack table(ist) is enabled
and the the target code segment is conforming(e2 & DESC_C_MASK), the
old implementation always set new CPL to 0, and SS.RPL to 0.
This is incorrect for when CPL3 code access a CPL0 conforming code
segment, the CPL should remain unchanged. Otherwise higher privileged
code can be compromised.
The patch fix this for always set dpl = cpl when the target code segment
is conforming, and modify the last parameter `flags`, which contains
correct new CPL, in cpu_x86_load_seg_cache().
Signed-off-by: Wu Xiang <willx8@gmail.com>
Message-Id: <20170621142152.GA18094@wxdeubuntu.ipads-lab.se.sjtu.edu.cn>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| target/i386/seg_helper.c | diffblobblamehistory |