Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751895AbbG3Pyg (ORCPT ); Thu, 30 Jul 2015 11:54:36 -0400 Received: from mail-wi0-f196.google.com ([209.85.212.196]:35989 "EHLO mail-wi0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751101AbbG3Pyf (ORCPT ); Thu, 30 Jul 2015 11:54:35 -0400 Subject: Re: Dealing with the NMI mess To: Andy Lutomirski , Willy Tarreau References: <20150723173105.6795c0dc@gandalf.local.home> <20150724081326.GO25159@twins.programming.kicks-ass.net> <20150724171018.GH3612@1wt.eu> Cc: Peter Zijlstra , Linus Torvalds , Steven Rostedt , X86 ML , "linux-kernel@vger.kernel.org" , Borislav Petkov , Thomas Gleixner , Brian Gerst From: Paolo Bonzini X-Enigmail-Draft-Status: N1110 Message-ID: <55BA48B7.9020500@redhat.com> Date: Thu, 30 Jul 2015 17:54:31 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1624 Lines: 36 On 24/07/2015 19:20, Andy Lutomirski wrote: > > Andy, section 5.8 of the SDM makes me think we could possibly abuse SYSRET > > to emulate IRET, and then possibly simplify the flags processing. It says > > that it takes the CPL3 code segment but nowhere it says that the target is > > validated for effectively being userland, and further it suggests that it > > doesn't validate anything : > > > > "It is the responsibility of the OS to ensure the descriptors in > > the GDT/LDT correspond to the selectors loaded by SYSCALL/SYSRET > > (consistent with the base, limit, and attribute values forced by > > the instructions)." > You are an evil bastard. I seriously doubt that this will work. > SYSRET goes to CPL3 no matter what. Also, I don't think you want to > start poking at MSRs to return. On Intel the bottom two bits of the selector are forced to 11. The pseudocode of SYSRET in the SDM has an explicit CS.Selector ← (IA32_STAR[63:48]+ either 0 or 16) OR 3; ... SS.Selector ← (IA32_STAR[63:48]+8) OR 3; On AMD it's even worse, because you get a weird state with CS.DPL=CS.RPL=SS.DPL=SS.RPL=0 but still the CPL is 3. This is seriously messed up because the CPL is always SS.DPL except in this case. AMD even had to add a separate field for the CPL to their VM control block, just to account for this case. Intel more sanely uses SS.DPL. Paolo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/