Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save

qemu-devel

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save

From:	Kevin O'Connor
Subject:	Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm.
Date:	Wed, 14 May 2014 20:20:59 -0400
User-agent:	Mutt/1.5.23 (2014-03-12)

On Wed, May 14, 2014 at 10:05:47AM +0200, Paolo Bonzini wrote:
> CPL isn't even altered when CS is reloaded, because you cannot jump out
> of ring-0 except with an inter-privilege IRET, and that reloads SS too.
> 
> An IRET or task switch is also the only way to set EFLAGS.VM, and it will
> hardcode SS.DPL=3, again matching CPL=3.
> 
> Finally, to get out of real mode you need to have CPL=0, and whatever got
> you at CPL has also loaded SS with a ring-0 stack.  This means that SS.DPL=0
> right after clearing CR0.PE.
> 
> Using SS.DPL as the CPL really sounds like the right approach.  I 
> tried it on my KVM testcase, and it works well.  For QEMU, even the
> special case of SYSRET will be handled fine because QEMU does set 
> SS.DPL = 3:
> 
>         cpu_x86_load_seg_cache(env, R_SS, selector + 8,
>                                0, 0xffffffff,
>                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
>                                DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
>                                DESC_W_MASK | DESC_A_MASK);
> 
> SS.DPL=CPL=3, SS.RPL=selector & 3 is a mix of Intel behavior (which is 
> SS.DPL=SS.RPL=CPL=3) and AMD behavior (because they set CPL=3 but 
> SS.DPL=SS.RPL=selector & 3).  We may want to match Intel behavior,
> but that's a different change.
> 
> Can you check if this patch works for you, and if so reply with
> Tested-by/Reviewed-by?

Your patch causes Freedos to crash when emm386 is loaded, so I think
it broke VM86 mode.  Below are some logs I took from qemu at the point
of the crash.

-Kevin


==================== Freedos with unmodified QEMU 2.0.0 (and SeaBIOS master)


IN: 
0x000000000012276e:  mov    %cr0,%eax
0x0000000000122771:  or     $0x80000000,%eax
0x0000000000122777:  mov    %eax,%cr0

EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012277a:  iretl  

EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL  
EFER=0000000000000000
Servicing hardware INT=0x08
     0: v=08 e=0000 i=0 cpl=3 IP=0930:00000000000001c9 pc=00000000000094c9 
SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012279c:  call   0x122070


==================== Freedos with patched QEMU (and SeaBIOS master)


IN: 
0x000000000012276e:  mov    %cr0,%eax
0x0000000000122771:  or     $0x80000000,%eax
0x0000000000122777:  mov    %eax,%cr0

EAX=00125000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=000006fe EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=00000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=00126360 CCO=EFLAGS  
EFER=0000000000000000
----------------
IN: 
0x000000000012277a:  iretl  

EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=000001dc
EIP=0000070a EFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
CS =000c 00122070 00002713 00009a00 DPL=0 CS16 [-R-]
SS =0038 00003820 00000200 00009200 DPL=0 DS16 [-W-]
DS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
FS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
GS =0014 00003a60 00000b8c 00009300 DPL=0 DS16 [-WA]
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=LOGICL  
EFER=0000000000000000
Servicing hardware INT=0x08
     0: v=08 e=0000 i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 
SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011
EAX=80000011 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000100
EIP=000001c9 EFL=00023202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00000000
CS =0930 00009300 0000ffff 00000000
SS =0920 00009200 0000ffff 00000000
DS =03a6 00003a60 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0008 00003d64 00000020 00008200 DPL=0 LDT
TR =0010 00110000 00002069 00008900 DPL=0 TSS32-avl
GDT=     00003ce4 0000007f
IDT=     00124784 000007ff
CR0=80000011 CR2=00000000 CR3=00125000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 
DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
CCS=00000000 CCD=80000011 CCO=EFLAGS  
EFER=0000000000000000
check_exception old: 0xffffffff new 0xd
     1: v=0d e=000c i=0 cpl=0 IP=0930:00000000000001c9 pc=00000000000094c9 
SP=0920:0000000000000100 env->regs[R_EAX]=0000000080000011

[Prev in Thread]

Current Thread

[Next in Thread]

Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Paolo Bonzini, 2014/05/13
- Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Kevin O'Connor, 2014/05/13
  - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Paolo Bonzini, 2014/05/13
    - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Paolo Bonzini, 2014/05/13
  - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Kevin O'Connor, 2014/05/13
    - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Paolo Bonzini, 2014/05/14
    - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Kevin O'Connor <=
    - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Kevin O'Connor, 2014/05/14
    - Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm., Paolo Bonzini, 2014/05/15

Prev by Date: Re: [Qemu-devel] [PATCH 5/7] target-arm: add emulation of PSCI calls for system emulation
Next by Date: Re: [Qemu-devel] [PATCH v2] qcow2: Patch for shrinking qcow2 disk image
Previous by thread: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm.
Next by thread: Re: [Qemu-devel] [PATCH] SMI handler should set the CPL to zero and save and restore it on rsm.
Index(es):
- Date
- Thread