* [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks
@ 2016-10-14 10:06 Andrew Cooper
2016-10-14 10:06 ` [PATCH 2/2] x86/hvm: Clobber %cs.L when LME becomes set Andrew Cooper
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Andrew Cooper @ 2016-10-14 10:06 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Jan Beulich
Contrary to the description in the software manuals, in Long Mode, attempts to
load %cs check that D is not set in combination with L before the present flag
is checked.
This can be observed because the L/D check fails with #GP before the presence
check failes with #NP
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
---
xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 793ce30..b23cd99 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1405,6 +1405,14 @@ protmode_load_seg(
/* Non-conforming segment: check RPL and DPL against CPL. */
: rpl > cpl || dpl != cpl )
goto raise_exn;
+ /*
+ * 64-bit code segments (L bit set) must have D bit clear.
+ * Experimentally in long mode, the L and D bits are checked before
+ * the Present bit.
+ */
+ if ( in_longmode(ctxt, ops) &&
+ (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
+ goto raise_exn;
sel = (sel ^ rpl) | cpl;
break;
case x86_seg_ss:
@@ -1444,11 +1452,6 @@ protmode_load_seg(
goto raise_exn;
}
- /* 64-bit code segments (L bit set) must have D bit clear. */
- if ( seg == x86_seg_cs && in_longmode(ctxt, ops) &&
- (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
- goto raise_exn;
-
/* Ensure Accessed flag is set. */
if ( a_flag && !(desc.b & a_flag) )
{
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] x86/hvm: Clobber %cs.L when LME becomes set
2016-10-14 10:06 [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Andrew Cooper
@ 2016-10-14 10:06 ` Andrew Cooper
2016-10-14 10:29 ` Jan Beulich
2016-10-14 10:28 ` [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Jan Beulich
2016-10-14 14:10 ` Konrad Rzeszutek Wilk
2 siblings, 1 reply; 6+ messages in thread
From: Andrew Cooper @ 2016-10-14 10:06 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Jan Beulich
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
---
xen/arch/x86/hvm/hvm.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index ceb89c7..3c90ecd 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2037,6 +2037,30 @@ int hvm_set_efer(uint64_t value)
return X86EMUL_EXCEPTION;
}
+ if ( (value & EFER_LME) && !(v->arch.hvm_vcpu.guest_efer & EFER_LME) )
+ {
+ struct segment_register cs;
+
+ hvm_get_segment_register(v, x86_seg_cs, &cs);
+
+ /*
+ * %cs may be loaded with both .D and .L set in legacy mode, and both
+ * are captured in the VMCS/VMCB.
+ *
+ * If a guest does this and then tries to transition into long mode,
+ * the vmentry from setting LME fails due to invalid guest state,
+ * because %cr0.PG is still clear.
+ *
+ * When LME becomes set, clobber %cs.L to keep the guest firmly in
+ * compatibility mode until it reloads %cs itself.
+ */
+ if ( cs.attr.fields.l )
+ {
+ cs.attr.fields.l = 0;
+ hvm_set_segment_register(v, x86_seg_cs, &cs);
+ }
+ }
+
if ( nestedhvm_enabled(v->domain) && cpu_has_svm &&
((value & EFER_SVME) == 0 ) &&
((value ^ v->arch.hvm_vcpu.guest_efer) & EFER_SVME) )
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks
2016-10-14 10:06 [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Andrew Cooper
2016-10-14 10:06 ` [PATCH 2/2] x86/hvm: Clobber %cs.L when LME becomes set Andrew Cooper
@ 2016-10-14 10:28 ` Jan Beulich
2016-10-14 10:32 ` Andrew Cooper
2016-10-14 14:10 ` Konrad Rzeszutek Wilk
2 siblings, 1 reply; 6+ messages in thread
From: Jan Beulich @ 2016-10-14 10:28 UTC (permalink / raw)
To: Andrew Cooper; +Cc: Xen-devel
>>> On 14.10.16 at 12:06, <andrew.cooper3@citrix.com> wrote:
> Contrary to the description in the software manuals, in Long Mode, attempts to
> load %cs check that D is not set in combination with L before the present flag
> is checked.
>
> This can be observed because the L/D check fails with #GP before the presence
> check failes with #NP
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
But I think it would be worthwhile mentioning that this restores
things to v1 of what became commit 78ff18c90.
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks
2016-10-14 10:28 ` [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Jan Beulich
@ 2016-10-14 10:32 ` Andrew Cooper
0 siblings, 0 replies; 6+ messages in thread
From: Andrew Cooper @ 2016-10-14 10:32 UTC (permalink / raw)
To: Jan Beulich; +Cc: Xen-devel
On 14/10/16 11:28, Jan Beulich wrote:
>>>> On 14.10.16 at 12:06, <andrew.cooper3@citrix.com> wrote:
>> Contrary to the description in the software manuals, in Long Mode, attempts to
>> load %cs check that D is not set in combination with L before the present flag
>> is checked.
>>
>> This can be observed because the L/D check fails with #GP before the presence
>> check failes with #NP
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
>
> But I think it would be worthwhile mentioning that this restores
> things to v1 of what became commit 78ff18c90.
I will update the comment to include this.
~Andrew
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks
2016-10-14 10:06 [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Andrew Cooper
2016-10-14 10:06 ` [PATCH 2/2] x86/hvm: Clobber %cs.L when LME becomes set Andrew Cooper
2016-10-14 10:28 ` [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Jan Beulich
@ 2016-10-14 14:10 ` Konrad Rzeszutek Wilk
2 siblings, 0 replies; 6+ messages in thread
From: Konrad Rzeszutek Wilk @ 2016-10-14 14:10 UTC (permalink / raw)
To: Andrew Cooper, paul.c.lai, sherry.hurwitz; +Cc: Jan Beulich, Xen-devel
On Fri, Oct 14, 2016 at 11:06:55AM +0100, Andrew Cooper wrote:
> Contrary to the description in the software manuals, in Long Mode, attempts to
> load %cs check that D is not set in combination with L before the present flag
> is checked.
>
> This can be observed because the L/D check fails with #GP before the presence
> check failes with #NP
CC-ing Paul and Sherry.
Perhaps the SDMs should mention this as well?
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> ---
> xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
> index 793ce30..b23cd99 100644
> --- a/xen/arch/x86/x86_emulate/x86_emulate.c
> +++ b/xen/arch/x86/x86_emulate/x86_emulate.c
> @@ -1405,6 +1405,14 @@ protmode_load_seg(
> /* Non-conforming segment: check RPL and DPL against CPL. */
> : rpl > cpl || dpl != cpl )
> goto raise_exn;
> + /*
> + * 64-bit code segments (L bit set) must have D bit clear.
> + * Experimentally in long mode, the L and D bits are checked before
> + * the Present bit.
> + */
> + if ( in_longmode(ctxt, ops) &&
> + (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
> + goto raise_exn;
> sel = (sel ^ rpl) | cpl;
> break;
> case x86_seg_ss:
> @@ -1444,11 +1452,6 @@ protmode_load_seg(
> goto raise_exn;
> }
>
> - /* 64-bit code segments (L bit set) must have D bit clear. */
> - if ( seg == x86_seg_cs && in_longmode(ctxt, ops) &&
> - (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
> - goto raise_exn;
> -
> /* Ensure Accessed flag is set. */
> if ( a_flag && !(desc.b & a_flag) )
> {
> --
> 2.1.4
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> https://lists.xen.org/xen-devel
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-10-14 14:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-14 10:06 [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Andrew Cooper
2016-10-14 10:06 ` [PATCH 2/2] x86/hvm: Clobber %cs.L when LME becomes set Andrew Cooper
2016-10-14 10:29 ` Jan Beulich
2016-10-14 10:28 ` [PATCH 1/2] x86/hvm: Correct the position of the %cs L/D checks Jan Beulich
2016-10-14 10:32 ` Andrew Cooper
2016-10-14 14:10 ` Konrad Rzeszutek Wilk
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.