qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Kevin O'Connor <kevin@koconnor.net>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>,
	Gerd Hoffmann <kraxel@redhat.com>,
	qemu-devel@nongnu.org, marcel.a@redhat.com
Subject: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm.
Date: Wed, 14 May 2014 20:20:59 -0400	[thread overview]
Message-ID: <20140515002059.GA28484@morn.localdomain> (raw)
In-Reply-To: <537323DB.5070005@redhat.com>

On Wed, May 14, 2014 at 10:05:47AM +0200, Paolo Bonzini wrote:
> CPL isn't even altered when CS is reloaded, because you cannot jump out
> of ring-0 except with an inter-privilege IRET, and that reloads SS too.
> 
> An IRET or task switch is also the only way to set EFLAGS.VM, and it will
> hardcode SS.DPL=3, again matching CPL=3.
> 
> Finally, to get out of real mode you need to have CPL=0, and whatever got
> you at CPL has also loaded SS with a ring-0 stack.  This means that SS.DPL=0
> right after clearing CR0.PE.
> 
> Using SS.DPL as the CPL really sounds like the right approach.  I 
> tried it on my KVM testcase, and it works well.  For QEMU, even the
> special case of SYSRET will be handled fine because QEMU does set 
> SS.DPL = 3:
> 
>         cpu_x86_load_seg_cache(env, R_SS, selector + 8,
>                                0, 0xffffffff,
>                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
>                                DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
>                                DESC_W_MASK | DESC_A_MASK);
> 
> SS.DPL=CPL=3, SS.RPL=selector & 3 is a mix of Intel behavior (which is 
> SS.DPL=SS.RPL=CPL=3) and AMD behavior (because they set CPL=3 but 
> SS.DPL=SS.RPL=selector & 3).  We may want to match Intel behavior,
> but that's a different change.
> 
> Can you check if this patch works for you, and if so reply with
> Tested-by/Reviewed-by?

Your patch causes Freedos to crash when emm386 is loaded, so I think
it broke VM86 mode.  Below are some logs I took from qemu at the point
of the crash.

-Kevin


==================== Freedos with unmodified QEMU 2.0.0 (and SeaBIOS master)


IN: 
0x000000000012276e:  mov    %cr0,%eax
0x0000000000122771:  or     $0x80000000,%eax
0x0000000000122777:  mov    %eax,%cr0

EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012277a:  iretl  

EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL  
EFER=0000000000000000
Servicing hardware INT=0x08
     0: v=08 e=0000 i=0 cpl=3 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012279c:  call   0x122070


==================== Freedos with patched QEMU (and SeaBIOS master)


IN: 
0x000000000012276e:  mov    %cr0,%eax
0x0000000000122771:  or     $0x80000000,%eax
0x0000000000122777:  mov    %eax,%cr0

EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012277a:  iretl  

EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL  
EFER=0000000000000000
Servicing hardware INT=0x08
     0: v=08 e=0000 i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS  
EFER=0000000000000000
check_exception old: 0xffffffff new 0xd
     1: v=0d e=000c i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011

  reply	other threads:[~2014-05-15  0:21 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20140425171718.GA1591@morn.localdomain>
     [not found] ` <535B772D.1020602@redhat.com>
     [not found]   ` <1398601366.21309.33.camel@localhost.localdomain>
     [not found]     ` <535D1445.3040905@redhat.com>
     [not found]       ` <20140427172524.GB28385@morn.localdomain>
2014-05-13 18:24         ` [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm Paolo Bonzini
2014-05-13 18:39           ` Kevin O'Connor
2014-05-13 18:57             ` Paolo Bonzini
2014-05-13 19:42               ` Paolo Bonzini
2014-05-13 22:07             ` Kevin O'Connor
2014-05-14  8:05               ` Paolo Bonzini
2014-05-15  0:20                 ` Kevin O'Connor [this message]
2014-05-15  1:32                   ` Kevin O'Connor
2014-05-15  6:35                     ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140515002059.GA28484@morn.localdomain \
    --to=kevin@koconnor.net \
    --cc=kraxel@redhat.com \
    --cc=marcel.a@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=rth@twiddle.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).