Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757094AbbDWLG0 (ORCPT ); Thu, 23 Apr 2015 07:06:26 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40499 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756301AbbDWLGX (ORCPT ); Thu, 23 Apr 2015 07:06:23 -0400 Message-ID: <5538D209.7030808@redhat.com> Date: Thu, 23 Apr 2015 13:05:45 +0200 From: Denys Vlasenko User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Borislav Petkov CC: Andy Lutomirski , Brian Gerst , Steven Rostedt , Oleg Nesterov , Ingo Molnar , "H. Peter Anvin" , Linus Torvalds , Andy Lutomirski , Will Drewry , =?UTF-8?B?RnLDqWTDqXJpYyBXZWlzYmVja2Vy?= , Alexei Starovoitov , Linux Kernel Mailing List , Kees Cook , Thomas Gleixner , "linux-tip-commits@vger.kernel.org" Subject: Re: [tip:x86/vdso] x86/vdso32/syscall.S: Do not load __USER32_DS to %ss References: <63da6d778f69fd0f1345d9287f6764d58be519fa.1427482099.git.luto@kernel.org> <5538C1C5.7010408@redhat.com> <20150423101840.GC28327@pd.tnic> <5538C8E3.60009@redhat.com> <20150423104401.GF28327@pd.tnic> In-Reply-To: <20150423104401.GF28327@pd.tnic> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1371 Lines: 29 On 04/23/2015 12:44 PM, Borislav Petkov wrote: > On Thu, Apr 23, 2015 at 12:26:43PM +0200, Denys Vlasenko wrote: >> Yes. It loads *selector*. AMD docs say that selector is loaded as you say, >> but *cached descriptor* of SS (which is a different entity) is not modified. >> >> If *cached descriptor* is invalid, in 32-bit mode stack ops >> will fail. (In 64-bit mode, CPU doesn't do those checks). > > So how can that happen with wine? Something's changing the cached > descriptor ... ? Yes. We know of at least one case where documentation (both Intel and AMD) specifically states that %ss is set to NULL: this happens on every interrupt and exception. If interrupt/exception returns to the same task with IRET, all is well: %ss is reloaded from iret frame (both selector and cached descriptor). However, if interrupt results in a preemption, we end up in a different task (say, Wine), and we can return to its userspace code with SYSRETL. *This* type of return does not reload cached descriptor. I don't know why it happens only with Wine. Maybe it just happens with Wine much more easily than with other 32-bit tasks? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/