[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 11/11] x86: fix SS selector in SYSRET
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 11/11] x86: fix SS selector in SYSRET |
Date: |
Tue, 10 Mar 2015 11:38:00 +0100 |
From: Bill Paul <address@hidden>
According to my reading of the Intel documentation, the SYSRET instruction
is supposed to force the RPL bits of the %ss register to 3 when returning
to user mode. The actual sequence is:
SS.Selector <-- (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *)
However, the code in helper_sysret() leaves them at 0 (in other words, the "OR
3" part of the above sequence is missing). It does set the privilege level
bits of %cs correctly though.
This has caused me trouble with some of my VxWorks development: code that runs
okay on real hardware will crash on QEMU, unless I apply the patch below.
Signed-off-by: Bill Paul <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
target-i386/seg_helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index fa374d0..2bc757a 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -1043,7 +1043,7 @@ void helper_sysret(CPUX86State *env, int dflag)
DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
env->eip = (uint32_t)env->regs[R_ECX];
}
- cpu_x86_load_seg_cache(env, R_SS, selector + 8,
+ cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3,
0, 0xffffffff,
DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
@@ -1056,7 +1056,7 @@ void helper_sysret(CPUX86State *env, int dflag)
DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
env->eip = (uint32_t)env->regs[R_ECX];
- cpu_x86_load_seg_cache(env, R_SS, selector + 8,
+ cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3,
0, 0xffffffff,
DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
--
2.3.0
- [Qemu-devel] [PULL 00/11] scsi, RCU, KVM, x86 changes for 2015-03-10, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 01/11] iscsi: Fix check for username, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 03/11] kvm_stat: add kvm_stat.1 man page, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 04/11] qemu-thread: do not use PTHREAD_MUTEX_ERRORCHECK, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 05/11] rcu: handle forks safely, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 08/11] hw: Propagate errors through qdev_prop_set_drive(), Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 06/11] cpus: initialize cpu->memory_dispatch, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 02/11] kvm_stat: add column headers to text UI, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 09/11] scsi: Improve error reporting for invalid drive property, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 07/11] scsi: Clean up duplicated error in legacy if=scsi code, Paolo Bonzini, 2015/03/10
- [Qemu-devel] [PULL 11/11] x86: fix SS selector in SYSRET,
Paolo Bonzini <=
- [Qemu-devel] [PULL 10/11] scsi: Convert remaining PCI HBAs to realize(), Paolo Bonzini, 2015/03/10
- Re: [Qemu-devel] [PULL 00/11] scsi, RCU, KVM, x86 changes for 2015-03-10, Peter Maydell, 2015/03/10