x86_64/cpu: reload the task register

When execution enters the kernel, no specific task register state has
been established, leaving the power-on state of the CPU itself active.
We have no control over that state, ergo we need to reload the task
register to point to descriptor under our control.

The earliest point when we can do that is after the new global
descriptor table has been loaded. Thus this is the exact point where we
do that.

Additionally, reloading the TR has unveiled another latent bug that was
present since the early days of the CPU initialization code: The TSS
descriptor was actually incorrect. The reason for this not having been
revealed earlier, is that the CPU was quietly using the TR set up by
by its own power-on bootstrap. Once a load with the existing, non-TSS,
descriptor was issued, A #GP was triggered because the CPU detected
that the referenced TSS descriptor is not in fact a TSS descriptor
(subtype 0x9):

----- BEGIN EXCEPTION DUMP -----
check_exception old: 0xffffffff new 0xd
     0: v=0d e=0028 i=0 cpl=0 IP=0008:ffffffff80281b12 pc=ffffffff80281b12 SP=0010:ffffffff80216390 env->regs[R_EAX]=0000000000000028
RAX=0000000000000028 RBX=0000000000000000 RCX=ffffffff80216100 RDX=ffffffff8010fca0
RSI=0000000000000050 RDI=ffffffff80216260 RBP=ffffffff802163d0 RSP=ffffffff80216390
R8 =ffffffff802160f7 R9 =ffffffff80115328 R10=ffffffff8021626c R11=0000000000000000
R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000
RIP=ffffffff80281b12 RFL=00000092 [--S-A--] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0010 0000000000000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
CS =0008 0000000000000000 ffffffff 00af9800 DPL=0 CS64 [---]
SS =0010 0000000000000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
DS =0010 0000000000000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
FS =0010 0000000000000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
GS =0010 0000000000000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
LDT=0000 0000000000000000 0000ffff 00008200 DPL=0 LDT
TR =0000 0000000000000000 0000ffff 00008b00 DPL=0 TSS64-busy
GDT=     ffffffff801154e0 000001bf
IDT=     0000000000000000 00000000
CR0=80000013 CR2=0000000000000000 CR3=0000000000102000 CR4=00000620
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
CCS=0000000000000090 CCD=ffffffff802161f8 CCO=EFLAGS
EFER=0000000000000500
----- END EXCEPTION DUMP -----

Decoding the e= value of the exception shows that the #GP occurred
while the CPU was trying to process index 5 of the GDT (bits 3-15
define the index, with e=0028 being 0000'0000'0010'1000 => index 5).
The layout of a system segment descriptor differs from a normal segment
descriptor in that the accessed, read/write, conforming, and executable
bits change their meaning into a 4-bit subtype number. For a TSS
descriptor, this subtype number must be 9.

In the future, the data structures of the GDT implementation should be
revised to ensure this kind of misconfiguration can not happen again.

0 files changed, 0 insertions, 0 deletions