From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49501) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkIah-0006Qv-6z for qemu-devel@nongnu.org; Tue, 13 May 2014 15:42:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WkIab-0008PN-8q for qemu-devel@nongnu.org; Tue, 13 May 2014 15:42:19 -0400 Received: from mail-ee0-x22e.google.com ([2a00:1450:4013:c00::22e]:35630) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkIab-0008Ox-2b for qemu-devel@nongnu.org; Tue, 13 May 2014 15:42:13 -0400 Received: by mail-ee0-f46.google.com with SMTP id t10so723634eei.33 for ; Tue, 13 May 2014 12:42:12 -0700 (PDT) Sender: Paolo Bonzini Message-ID: <5372758E.4010304@redhat.com> Date: Tue, 13 May 2014 21:42:06 +0200 From: Paolo Bonzini MIME-Version: 1.0 References: <20140425171718.GA1591@morn.localdomain> <535B772D.1020602@redhat.com> <1398601366.21309.33.camel@localhost.localdomain> <535D1445.3040905@redhat.com> <20140427172524.GB28385@morn.localdomain> <5372636F.8080101@redhat.com> <20140513183920.GA23439@morn.localdomain> <53726AFE.9010001@redhat.com> In-Reply-To: <53726AFE.9010001@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Kevin O'Connor Cc: qemu-devel@nongnu.org, marcel.a@redhat.com, Gerd Hoffmann , Richard Henderson Il 13/05/2014 20:57, Paolo Bonzini ha scritto: > Il 13/05/2014 20:39, Kevin O'Connor ha scritto: >> That doesn't sound right. What happens if the processor takes an NMI, >> SMI, or VMEXIT between the point it enables protected mode but before >> it long jumps? The processor would have to save and restore the CPL >> somewhere for all of these situations. > > For VMEXITs it's up to the hypervisor to make it work properly. I just > posted today fixes for KVM. > > I guess the answer for NMIs is "good luck". But in the case of NMIs, > wouldn't it be broken anyway, because the IDT format is different > between real mode and protected mode? > > For SMIs, http://www.sandpile.org/x86/smm.htm says that the CPL is > stored somewhere in SMRAM. I think your patches are an improvement > anyway, we can build a more complete fix on top of them. On second thought, the CPL should always be equal to SS.DPL, even during real mode transitions. Unlike CS.RPL, SS.DPL is hidden in the internal segment descriptor registers and is always zero. I say *should*, because of course there is an exception. :) CPL is forced to 3 by SYSRET, even if it loads SS with a selector whose RPL is not 3. So we're better off saving CPL in SMRAM (and perhaps make the SMRAM map equal to that of real processors). In any case, I think this is an example of how your patches are an improvement; it would be trivial to make CPL=SS.DPL on top of them. Paolo