From: Kevin O'Connor <kevin@koconnor.net>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>,
Gerd Hoffmann <kraxel@redhat.com>,
qemu-devel@nongnu.org, marcel.a@redhat.com
Subject: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm.
Date: Wed, 14 May 2014 20:20:59 -0400 [thread overview]
Message-ID: <20140515002059.GA28484@morn.localdomain> (raw)
In-Reply-To: <537323DB.5070005@redhat.com>
On Wed, May 14, 2014 at 10:05:47AM +0200, Paolo Bonzini wrote:
> CPL isn't even altered when CS is reloaded, because you cannot jump out
> of ring-0 except with an inter-privilege IRET, and that reloads SS too.
>
> An IRET or task switch is also the only way to set EFLAGS.VM, and it will
> hardcode SS.DPL=3, again matching CPL=3.
>
> Finally, to get out of real mode you need to have CPL=0, and whatever got
> you at CPL has also loaded SS with a ring-0 stack. This means that SS.DPL=0
> right after clearing CR0.PE.
>
> Using SS.DPL as the CPL really sounds like the right approach. I
> tried it on my KVM testcase, and it works well. For QEMU, even the
> special case of SYSRET will be handled fine because QEMU does set
> SS.DPL = 3:
>
> cpu_x86_load_seg_cache(env, R_SS, selector + 8,
> 0, 0xffffffff,
> DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
> DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
> DESC_W_MASK | DESC_A_MASK);
>
> SS.DPL=CPL=3, SS.RPL=selector & 3 is a mix of Intel behavior (which is
> SS.DPL=SS.RPL=CPL=3) and AMD behavior (because they set CPL=3 but
> SS.DPL=SS.RPL=selector & 3). We may want to match Intel behavior,
> but that's a different change.
>
> Can you check if this patch works for you, and if so reply with
> Tested-by/Reviewed-by?
Your patch causes Freedos to crash when emm386 is loaded, so I think
it broke VM86 mode. Below are some logs I took from qemu at the point
of the crash.
-Kevin
==================== Freedos with unmodified QEMU 2.0.0 (and SeaBIOS master)
IN:
0x000000000012276e: mov %cr0,%eax
0x0000000000122771: or $0x80000000,%eax
0x0000000000122777: mov %eax,%cr0
EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS
EFER=0000000000000000
----------------
IN:
0x000000000012277a: iretl
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL
EFER=0000000000000000
Servicing hardware INT=0x08
0: v=08 e=0000 i=0 cpl=3 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS
EFER=0000000000000000
----------------
IN:
0x000000000012279c: call 0x122070
==================== Freedos with patched QEMU (and SeaBIOS master)
IN:
0x000000000012276e: mov %cr0,%eax
0x0000000000122771: or $0x80000000,%eax
0x0000000000122777: mov %eax,%cr0
EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS
EFER=0000000000000000
----------------
IN:
0x000000000012277a: iretl
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL
EFER=0000000000000000
Servicing hardware INT=0x08
0: v=08 e=0000 i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT= 00003ce4 0000007f
IDT= 00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS
EFER=0000000000000000
check_exception old: 0xffffffff new 0xd
1: v=0d e=000c i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
next prev parent reply other threads:[~2014-05-15 0:21 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20140425171718.GA1591@morn.localdomain>
[not found] ` <535B772D.1020602@redhat.com>
[not found] ` <1398601366.21309.33.camel@localhost.localdomain>
[not found] ` <535D1445.3040905@redhat.com>
[not found] ` <20140427172524.GB28385@morn.localdomain>
2014-05-13 18:24 ` [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm Paolo Bonzini
2014-05-13 18:39 ` Kevin O'Connor
2014-05-13 18:57 ` Paolo Bonzini
2014-05-13 19:42 ` Paolo Bonzini
2014-05-13 22:07 ` Kevin O'Connor
2014-05-14 8:05 ` Paolo Bonzini
2014-05-15 0:20 ` Kevin O'Connor [this message]
2014-05-15 1:32 ` Kevin O'Connor
2014-05-15 6:35 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140515002059.GA28484@morn.localdomain \
--to=kevin@koconnor.net \
--cc=kraxel@redhat.com \
--cc=marcel.a@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).