Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: ieff94742:Fastmail
User-Agent: Cyrus-JMAP/3.7.0-alpha0-1115-g8b801eadce-fm-20221102.001-g8b801ead
Mime-Version: 1.0
Message-Id: <b2896f0c-5e0d-43c9-8ead-487bf1572168@app.fastmail.com>
In-Reply-To: <85ca9ae1-d319-ee77-4a71-bc9c7874f2cb@yandex.ru>
References: <85ca9ae1-d319-ee77-4a71-bc9c7874f2cb@yandex.ru>
Date:   Mon, 12 Dec 2022 13:59:47 -0800
From:   "Andy Lutomirski" <luto@kernel.org>
To:     stsp <stsp2@yandex.ru>,
        "Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>
Cc:     linux-x86_64@vger.kernel.org
Subject: Re: strange behavior with sigreturn() to 32bit
Content-Type: text/plain
Precedence: bulk

On Sat, Dec 10, 2022, at 1:08 AM, stsp wrote:
> Hi.
>
> I am playing with 32bit compatibility segments,
> and I am observing something very strange.
> To demonstrate the problem, I did the change
> to the kernel sigreturn test-case, and it is attached.
> The change just moves the magic value to EAX
> and calls an interrupt that produces a SIGSEGV.
> The SIGSEGV handler prints the needed regs.
> This patch intentionally adds 0x100000000 to
> the RIP register, because AFAIK the high part
> or 64bit regs are irrelevant in compatibility mode.
> Now with high part of RIP non-zero, we see this:
> $ ./sigreturn_64
> err=0 trapno=d ax=0 ip=100000003
>
> OK, obviously our asm code didn't execute -
> why is so? How does the high part of RIP
> affect compatibility mode?
> Then lets start the same example under gdb:
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000403008 in int31 ()
> (gdb)
> Continuing.
> err=18a trapno=d ax=a5f3 ip=403008
>
> Wow! Much better now: error code is correct,
> ax is correct, but ip is invalid.

I generally distrust gdb when mixed modes are involved -- it's fundamentally intensely buggy.  Now maybe you're not hitting the bugs I know of, but still...

Anyway, the behavior I expect (not that I've tested this, but based on my memory of how this is all supposed to work) is that an attempt to return to user mode will fail with #GP because the full value of RIP is compared to the segment limit, which is 2^32-1.  And #GP is 0xd, so your non-gdb outputs look broadly correct...