1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
Guest Mode PL Mon Mode Mon Mode Monitor what if virtualized?
(no virt) (with virt)
============================================================================
VM86 n/a VM86 (1) PM CS^32 CS/GS overrides
all selector reads
RM (RM desc) n/a VM86 (2) PM CS^32 CS/GS overrides
all selector reads
RM (PM desc) n/a ---- (3) PM CS^32 CS/GS overrides
all selector reads
PM16 {0,1,2} ---- (4) PM CS^32 CS/GS overrides
all selector reads
PM16 {3} PM16 (5) PM CS^32 CS/GS overrides
CS/GS selector reads
PM32 {0,1,2} ---- (4) PM CS32 CS/GS overrides
all selector reads
PM32 {3} PM32 (5) PM CS32 CS/GS overrides
CS/GS selector reads
Key:
RM desc: Real Mode compatible descriptor cache values
RM desc: Protected Mode legacy values (from PM->RM switch, but
before segment has been reloaded.
CS/GS overrides: Use of the CS/GS segments by guest code is virtualized
so that CS may point to the translated code (tcode) buffer and
other monitor. And GS is used as a data segment by the
ring3 handler functions and in tcode which calls them. Thus,
virtualize instructions which use CS/GS prefixes.
CS32: Use a 32-bit CS (virtualized) segment, and 32-bit tcode.
CS^32: Use a 32-bit CS (virtualized) segment, and massage the
guest code to negate the opsize/addrsize of each instruction.
This lets us easily call the ring3 handlers, since everything
is really running in 32-bit space.
Notes:
(1) Not sure about system-oriented EFLAGS bits, if they
are modified from original values.
(2) Not 100% clean. SMSW can detect Mon Mode VM86.
EFLAGS.IF==0 is also a problem, unless we can use VIF.
(3) Not possible using current architecture. If the descriptor
caches have legacy values from Protected Mode, VM86 can
not be used, since it will reload them with RM compatible
values upon IRET from monitor.
(4) Not possible using current architecture. We push all levels
down to CPL3, so we must monitor selector reads, because the
RPL values are modified.
(5) Instructions which can look in descriptor tables
can detect extra/modified descriptors.
For now, monitor all modes with PM CS32 or PM CS^32.
Add running PM16/PM32 @ CPL==3 without virtualization thereafter
(by user option).
|
