From: jan.kiszka@siemens.com (Jan Kiszka) Subject: [Qemu-devel] [PATCH 1/5] kqemu: x86-64: Run 16-bit-stack-return in ring 0 Date: Fri, 29 May 2009 19:18:31 +0200 Message-ID: <20090529171831.14265.89986.stgit@mchn012c.ww002.siemens.net> To: qemu-devel@nongnu.org The fix-up code for returning to 16 bit stack segments is currently executed in ring 1. This has the side effect that the interrupt flag remains cleared on return from ring 1 to the guest's ring 3 as its IOPL is 0 (ie. iret can only modify IF when run in ring 0). Fix this by moving the 32 bit return trampoline into ring 0. Signed-off-by: Jan Kiszka --- common/kernel.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git common/kernel.c common/kernel.c index 6a88452..1d7a69e 100644 Index: common/kernel.c --- common/kernel.c +++ common/kernel.c @@ -422,8 +422,8 @@ struct kqemu_state *kqemu_init(struct kqemu_init *d, #ifdef __x86_64__ s->monitor_ds_sel = 0; /* no need for a specific data segment */ /* used for 16 bit esp fix */ - s->monitor_cs32_sel = (s->monitor_selector_base + (7 << 3)) | 1; - s->monitor_ss16_sel = (s->monitor_selector_base + (6 << 3)) | 1; + s->monitor_cs32_sel = s->monitor_selector_base + (7 << 3); + s->monitor_ss16_sel = s->monitor_selector_base + (6 << 3); s->monitor_ss_null_sel = (s->monitor_selector_base + (1 << 3)) | 3; #else s->monitor_ds_sel = s->monitor_selector_base + (1 << 3); @@ -495,9 +495,9 @@ struct kqemu_state *kqemu_init(struct kqemu_init *d, 0, 0xfffff, 0xa09a); /* long mode segment */ set_seg((uint32_t *)(dt_table + (s->monitor_ss16_sel >> 3)), (s->monitor_data_vaddr + offsetof(struct kqemu_state, stack)) & ~0xffff, - 0xffff, 0x00b2); /* SS16 segment for 16 bit ESP fix */ + 0xffff, 0x0092); /* SS16 segment for 16 bit ESP fix */ set_seg((uint32_t *)(dt_table + (s->monitor_cs32_sel >> 3)), - 0, 0xfffff, 0xc0ba); /* CS32 segment for 16 bit ESP fix */ + 0, 0xfffff, 0xc09a); /* CS32 segment for 16 bit ESP fix */ set_seg((uint32_t *)(dt_table + (s->monitor_ss_null_sel >> 3)), 0, 0, 0x40f2); /* substitute for null SS segment */ #else