yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-01-10 22:35:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

target/i386: fix interrupt CPL error when using ist in x86-64

Browse source 
In do_interrupt64(), when interrupt stack table(ist) is enabled
and the the target code segment is conforming(e2 & DESC_C_MASK), the
old implementation always set new CPL to 0, and SS.RPL to 0.

This is incorrect for when CPL3 code access a CPL0 conforming code
segment, the CPL should remain unchanged. Otherwise higher privileged
code can be compromised.

The patch fix this for always set dpl = cpl when the target code segment
is conforming, and modify the last parameter `flags`, which contains
correct new CPL, in cpu_x86_load_seg_cache().

Backports commit e95e9b88ba5f4a6c17f4d0c3a3a6bf3f648bb328 from qemu
This commit is contained in:
Wu Xiang 2018-03-03 21:15:19 -05:00 committed by Lioncash
parent 0ef338aa71
commit a8de2d4748
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
qemu/target/i386/seg_helper.c
View file

@ -917,12 +917,14 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int,
}
new_stack = 0;
esp = env->regs[R_ESP];
dpl = cpl;
} else {
raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
new_stack = 0; /* avoid warning */
esp = 0; /* avoid warning */
}
if (e2 & DESC_C_MASK) {
dpl = cpl;
}
esp &= ~0xfLL; /* align stack */
PUSHQ(esp, env->segs[R_SS].selector);
@ -942,7 +944,7 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int,
if (new_stack) {
ss = 0 | dpl;
cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, dpl << DESC_DPL_SHIFT);
}
env->regs[R_ESP] = esp;