diff mbox

[1/2] x86/hvm: Correct the position of the %cs L/D checks

Message ID 1476439616-17287-1-git-send-email-andrew.cooper3@citrix.com (mailing list archive)
State New, archived
Headers show

Commit Message

Andrew Cooper Oct. 14, 2016, 10:06 a.m. UTC
Contrary to the description in the software manuals, in Long Mode, attempts to
load %cs check that D is not set in combination with L before the present flag
is checked.

This can be observed because the L/D check fails with #GP before the presence
check failes with #NP

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

Comments

Jan Beulich Oct. 14, 2016, 10:28 a.m. UTC | #1
>>> On 14.10.16 at 12:06, <andrew.cooper3@citrix.com> wrote:
> Contrary to the description in the software manuals, in Long Mode, attempts to
> load %cs check that D is not set in combination with L before the present flag
> is checked.
> 
> This can be observed because the L/D check fails with #GP before the presence
> check failes with #NP
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

But I think it would be worthwhile mentioning that this restores
things to v1 of what became commit 78ff18c90.

Jan
Andrew Cooper Oct. 14, 2016, 10:32 a.m. UTC | #2
On 14/10/16 11:28, Jan Beulich wrote:
>>>> On 14.10.16 at 12:06, <andrew.cooper3@citrix.com> wrote:
>> Contrary to the description in the software manuals, in Long Mode, attempts to
>> load %cs check that D is not set in combination with L before the present flag
>> is checked.
>>
>> This can be observed because the L/D check fails with #GP before the presence
>> check failes with #NP
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
>
> But I think it would be worthwhile mentioning that this restores
> things to v1 of what became commit 78ff18c90.

I will update the comment to include this.

~Andrew
Konrad Rzeszutek Wilk Oct. 14, 2016, 2:10 p.m. UTC | #3
On Fri, Oct 14, 2016 at 11:06:55AM +0100, Andrew Cooper wrote:
> Contrary to the description in the software manuals, in Long Mode, attempts to
> load %cs check that D is not set in combination with L before the present flag
> is checked.
> 
> This can be observed because the L/D check fails with #GP before the presence
> check failes with #NP

CC-ing Paul and Sherry.

Perhaps the SDMs should mention this as well?

> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> ---
>  xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
> index 793ce30..b23cd99 100644
> --- a/xen/arch/x86/x86_emulate/x86_emulate.c
> +++ b/xen/arch/x86/x86_emulate/x86_emulate.c
> @@ -1405,6 +1405,14 @@ protmode_load_seg(
>                 /* Non-conforming segment: check RPL and DPL against CPL. */
>                 : rpl > cpl || dpl != cpl )
>              goto raise_exn;
> +        /*
> +         * 64-bit code segments (L bit set) must have D bit clear.
> +         * Experimentally in long mode, the L and D bits are checked before
> +         * the Present bit.
> +         */
> +        if ( in_longmode(ctxt, ops) &&
> +             (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
> +            goto raise_exn;
>          sel = (sel ^ rpl) | cpl;
>          break;
>      case x86_seg_ss:
> @@ -1444,11 +1452,6 @@ protmode_load_seg(
>          goto raise_exn;
>      }
>  
> -    /* 64-bit code segments (L bit set) must have D bit clear. */
> -    if ( seg == x86_seg_cs && in_longmode(ctxt, ops) &&
> -         (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
> -        goto raise_exn;
> -
>      /* Ensure Accessed flag is set. */
>      if ( a_flag && !(desc.b & a_flag) )
>      {
> -- 
> 2.1.4
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> https://lists.xen.org/xen-devel
diff mbox

Patch

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 793ce30..b23cd99 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1405,6 +1405,14 @@  protmode_load_seg(
                /* Non-conforming segment: check RPL and DPL against CPL. */
                : rpl > cpl || dpl != cpl )
             goto raise_exn;
+        /*
+         * 64-bit code segments (L bit set) must have D bit clear.
+         * Experimentally in long mode, the L and D bits are checked before
+         * the Present bit.
+         */
+        if ( in_longmode(ctxt, ops) &&
+             (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
+            goto raise_exn;
         sel = (sel ^ rpl) | cpl;
         break;
     case x86_seg_ss:
@@ -1444,11 +1452,6 @@  protmode_load_seg(
         goto raise_exn;
     }
 
-    /* 64-bit code segments (L bit set) must have D bit clear. */
-    if ( seg == x86_seg_cs && in_longmode(ctxt, ops) &&
-         (desc.b & (1 << 21)) && (desc.b & (1 << 22)) )
-        goto raise_exn;
-
     /* Ensure Accessed flag is set. */
     if ( a_flag && !(desc.b & a_flag) )
     {