From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36166) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkHt4-0005av-LX for qemu-devel@nongnu.org; Tue, 13 May 2014 14:57:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WkHsy-0000z7-Id for qemu-devel@nongnu.org; Tue, 13 May 2014 14:57:14 -0400 Received: from mail-ee0-x22e.google.com ([2a00:1450:4013:c00::22e]:50352) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkHsy-0000yt-CQ for qemu-devel@nongnu.org; Tue, 13 May 2014 14:57:08 -0400 Received: by mail-ee0-f46.google.com with SMTP id t10so696575eei.19 for ; Tue, 13 May 2014 11:57:07 -0700 (PDT) Sender: Paolo Bonzini Message-ID: <53726AFE.9010001@redhat.com> Date: Tue, 13 May 2014 20:57:02 +0200 From: Paolo Bonzini MIME-Version: 1.0 References: <20140425171718.GA1591@morn.localdomain> <535B772D.1020602@redhat.com> <1398601366.21309.33.camel@localhost.localdomain> <535D1445.3040905@redhat.com> <20140427172524.GB28385@morn.localdomain> <5372636F.8080101@redhat.com> <20140513183920.GA23439@morn.localdomain> In-Reply-To: <20140513183920.GA23439@morn.localdomain> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Kevin O'Connor Cc: Richard Henderson , Gerd Hoffmann , qemu-devel@nongnu.org, marcel.a@redhat.com Il 13/05/2014 20:39, Kevin O'Connor ha scritto: > On Tue, May 13, 2014 at 08:24:47PM +0200, Paolo Bonzini wrote: >> Il 27/04/2014 19:25, Kevin O'Connor ha scritto: >>> I was wondering about that as well. The Intel docs state that the CPL >>> is bits 0-1 of the CS.selector register, and that protected mode >>> starts immediately after setting the PE bit. The CS.selector field >>> should be the value of %cs in real mode, which is the value added to >>> eip (after shifting right by 4). >>> >>> I guess that means that the real mode code that enables the PE bit >>> must run with a code segment aligned to a value of 4. (Which >>> effectively means code alignment of 64 bytes because of the segment >>> shift.) >> >> It turns out that this is not a requirement; which means that the >> protected mode transition is exactly the only place where CPL is not >> redundant. The CPL remains zero until you reload CS with a long jump. > > That doesn't sound right. What happens if the processor takes an NMI, > SMI, or VMEXIT between the point it enables protected mode but before > it long jumps? The processor would have to save and restore the CPL > somewhere for all of these situations. For VMEXITs it's up to the hypervisor to make it work properly. I just posted today fixes for KVM. I guess the answer for NMIs is "good luck". But in the case of NMIs, wouldn't it be broken anyway, because the IDT format is different between real mode and protected mode? For SMIs, http://www.sandpile.org/x86/smm.htm says that the CPL is stored somewhere in SMRAM. I think your patches are an improvement anyway, we can build a more complete fix on top of them. Paolo > If you are right, I think the whole series needs to be reworked.