From patchwork Fri Jun 23 11:19:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 779956 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3wvGFq5jThz9s8N for ; Fri, 23 Jun 2017 21:20:15 +1000 (AEST) Received: from localhost ([::1]:34863 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOMdI-0006lv-N5 for incoming@patchwork.ozlabs.org; Fri, 23 Jun 2017 07:20:12 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42919) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOMcr-0006lo-Sd for qemu-devel@nongnu.org; Fri, 23 Jun 2017 07:19:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dOMcm-00048e-U3 for qemu-devel@nongnu.org; Fri, 23 Jun 2017 07:19:45 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59350) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dOMcm-00048G-KR for qemu-devel@nongnu.org; Fri, 23 Jun 2017 07:19:40 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 83B2830315C; Fri, 23 Jun 2017 11:19:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 83B2830315C Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=pbonzini@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 83B2830315C Received: from [10.36.117.254] (ovpn-117-254.ams2.redhat.com [10.36.117.254]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E011C6EC85; Fri, 23 Jun 2017 11:19:36 +0000 (UTC) To: Wu Xiang , qemu-devel@nongnu.org References: <20170621142152.GA18094@wxdeubuntu.ipads-lab.se.sjtu.edu.cn> From: Paolo Bonzini Message-ID: <641e1f35-813a-4244-0194-ffce08130533@redhat.com> Date: Fri, 23 Jun 2017 13:19:35 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 MIME-Version: 1.0 In-Reply-To: <20170621142152.GA18094@wxdeubuntu.ipads-lab.se.sjtu.edu.cn> Content-Language: en-US X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 23 Jun 2017 11:19:38 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: Re: [Qemu-devel] [PATCH] target/i386: fix interrupt CPL error when using ist in x86-64 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , Richard Henderson Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" On 21/06/2017 16:21, Wu Xiang wrote: > In do_interrupt64(), when interrupt stack table(ist) is enabled > and the the target code segment is conforming(e2 & DESC_C_MASK), the > old implementation always set new CPL to 0, and SS.RPL to 0. > > This is incorrect for when CPL3 code access a CPL0 conforming code > segment, the CPL should remain unchanged. Otherwise higher privileged > code can be compromised. > > The patch fix this for always set dpl = cpl when the target code segment > is conforming, and modify the last parameter `flags`, which contains > correct new CPL, in cpu_x86_load_seg_cache(). > > Signed-off-by: Wu Xiang > --- > target/i386/seg_helper.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) The patch looks good, but I'm thinking of a cleanup on top that simplifies the handling of conforming code segments: Because dpl == cpl after the new "if", it's now unnecessary to check the C bit when testing dpl < cpl. Furthermore, dpl > cpl is checked slightly above this code, so the final "else" is unreachable. What do you think? Paolo > diff --git a/target/i386/seg_helper.c b/target/i386/seg_helper.c > index 0374031..9af69c2 100644 > --- a/target/i386/seg_helper.c > +++ b/target/i386/seg_helper.c > @@ -931,12 +931,14 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, > } > new_stack = 0; > esp = env->regs[R_ESP]; > - dpl = cpl; > } else { > raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); > new_stack = 0; /* avoid warning */ > esp = 0; /* avoid warning */ > } > + if (e2 & DESC_C_MASK) { > + dpl = cpl; > + } > esp &= ~0xfLL; /* align stack */ > > PUSHQ(esp, env->segs[R_SS].selector); > @@ -956,7 +958,7 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, > > if (new_stack) { > ss = 0 | dpl; > - cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0); > + cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, dpl << DESC_DPL_SHIFT); > } > env->regs[R_ESP] = esp; > > diff --git a/target/i386/seg_helper.c b/target/i386/seg_helper.c index 9af69c23e0..600a4d7586 100644 --- a/target/i386/seg_helper.c +++ b/target/i386/seg_helper.c @@ -692,7 +692,10 @@ static void do_interrupt_protected(CPUX86State *env, int intno, int is_int, if (!(e2 & DESC_P_MASK)) { raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); } - if (!(e2 & DESC_C_MASK) && dpl < cpl) { + if (e2 & DESC_C_MASK) { + dpl = cpl; + } + if (dpl < cpl) { /* to inner privilege */ get_ss_esp_from_tss(env, &ss, &esp, dpl, 0); if ((ss & 0xfffc) == 0) { @@ -719,7 +722,7 @@ static void do_interrupt_protected(CPUX86State *env, int intno, int is_int, new_stack = 1; sp_mask = get_sp_mask(ss_e2); ssp = get_seg_base(ss_e1, ss_e2); - } else if ((e2 & DESC_C_MASK) || dpl == cpl) { + } else { /* to same privilege */ if (vm86) { raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); @@ -728,13 +731,6 @@ static void do_interrupt_protected(CPUX86State *env, int intno, int is_int, sp_mask = get_sp_mask(env->segs[R_SS].flags); ssp = env->segs[R_SS].base; esp = env->regs[R_ESP]; - dpl = cpl; - } else { - raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); - new_stack = 0; /* avoid warning */ - sp_mask = 0; /* avoid warning */ - ssp = 0; /* avoid warning */ - esp = 0; /* avoid warning */ } shift = type >> 3; @@ -919,25 +915,21 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) { raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } - if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) { + if (e2 & DESC_C_MASK) { + dpl = cpl; + } + if (dpl < cpl || ist != 0) { /* to inner privilege */ new_stack = 1; esp = get_rsp_from_tss(env, ist != 0 ? ist + 3 : dpl); ss = 0; - } else if ((e2 & DESC_C_MASK) || dpl == cpl) { + } else { /* to same privilege */ if (env->eflags & VM_MASK) { raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } new_stack = 0; esp = env->regs[R_ESP]; - } else { - raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); - new_stack = 0; /* avoid warning */ - esp = 0; /* avoid warning */ - } - if (e2 & DESC_C_MASK) { - dpl = cpl; } esp &= ~0xfLL; /* align stack */