From nobody Tue Feb 10 01:30:58 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1606896707; cv=none; d=zohomail.com; s=zohoarc; b=DpJHzEplHdbNIBvbPdayTy1bAsMbh2gR3w7PSpAm4VANOxT09wSQLfYA9++hq/j27s4kWNg87kS2vWBczDbFpmLbf9OzAJI9SaDKdm2yrytLgWAPqoRHz39axjAUYJ2tJH7EfvKCXV7DYAoF1PF+0c6DqVyR8wNiudtaXAFawis= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1606896707; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=6L3C5VmH/yEj3gFyYIERhtGdgIC1jmMOPDs35NrC1mc=; b=BcEKtUNUrJDw5whWgfcpUUVd83mrT853bJ0jyIIQP+L9baP0f3pSvyXX8dV0B4hf3bS81Hbul64DeqME5WRSMkIH4PrImyaZu5YlGS6eoeNlCDw02OSFordib/Bbzrl+tSZAnyZCUw5PHcghaZhAM7dcGybZzCQISRPqqBm0Axc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1606896707384753.1464880463368; Wed, 2 Dec 2020 00:11:47 -0800 (PST) Received: from localhost ([::1]:41452 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kkNEo-0004d4-00 for importer@patchew.org; Wed, 02 Dec 2020 03:11:46 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:39570) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kkNC4-0002Od-UU for qemu-devel@nongnu.org; Wed, 02 Dec 2020 03:08:56 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:22939) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1kkNC3-0003Yt-74 for qemu-devel@nongnu.org; Wed, 02 Dec 2020 03:08:56 -0500 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-411-5tFkyzG5OJqfS8wRP8E04Q-1; Wed, 02 Dec 2020 03:08:52 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 99DAE5708A for ; Wed, 2 Dec 2020 08:08:51 +0000 (UTC) Received: from virtlab701.virt.lab.eng.bos.redhat.com (virtlab701.virt.lab.eng.bos.redhat.com [10.19.152.228]) by smtp.corp.redhat.com (Postfix) with ESMTP id 6594110013BD for ; Wed, 2 Dec 2020 08:08:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1606896534; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6L3C5VmH/yEj3gFyYIERhtGdgIC1jmMOPDs35NrC1mc=; b=KVjHeT25oDQolc/c6WEeuFO7D/Q8qK7nl93wyi78ijbkJVAo6clSQ18Bc10PwDH3P+dy/j C0VKc7U6qdQgIn6oxscOvE4M541WRG/8qz48txJ8nCZ00cfgC+dZSBbwOkUW57TMlJo7Qd B1QTZPpZJUc0zQbjehuuIt24CUoanak= X-MC-Unique: 5tFkyzG5OJqfS8wRP8E04Q-1 From: Paolo Bonzini To: qemu-devel@nongnu.org Subject: [PULL 003/113] target/i386: seg_helper: Correct segement selector nullification in the RET/IRET helper Date: Wed, 2 Dec 2020 03:06:59 -0500 Message-Id: <20201202080849.4125477-4-pbonzini@redhat.com> In-Reply-To: <20201202080849.4125477-1-pbonzini@redhat.com> References: <20201202080849.4125477-1-pbonzini@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=pbonzini@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=216.205.24.124; envelope-from=pbonzini@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -35 X-Spam_score: -3.6 X-Spam_bar: --- X-Spam_report: (-3.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.497, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @redhat.com) Content-Type: text/plain; charset="utf-8" From: Bin Meng Per the SDM, when returning to outer privilege level, for segment registers (ES, FS, GS, and DS) if the check fails, the segment selector becomes null, but QEMU clears the base/limit/flags as well as nullifying the segment selector, which should be a spec violation. Real hardware seems to be compliant with the spec, at least on one Coffee Lake board I tested. Signed-off-by: Bin Meng Message-Id: <1605261378-77971-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Paolo Bonzini --- target/i386/seg_helper.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target/i386/seg_helper.c b/target/i386/seg_helper.c index 09b6554660..e6ffa1f018 100644 --- a/target/i386/seg_helper.c +++ b/target/i386/seg_helper.c @@ -2108,7 +2108,10 @@ static inline void validate_seg(CPUX86State *env, in= t seg_reg, int cpl) if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { /* data or non conforming code segment */ if (dpl < cpl) { - cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0); + cpu_x86_load_seg_cache(env, seg_reg, 0, + env->segs[seg_reg].base, + env->segs[seg_reg].limit, + env->segs[seg_reg].flags & ~DESC_P_MASK= ); } } } --=20 2.26.2