lkml.org 
[lkml]   [2012]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectDo the x86 kernel entry points need an xabort on TSX cpus?
I just read the Intel TSX reference (Chapter 8 of the current
Instruction Set Extensions
Programming Reference). It says, in Section 8.3.8.1:

In addition, in some implementations, the following instructions may
always cause
transactional aborts. These instructions are not expected to be commonly used
inside typical transactional regions. However, programmers must not
rely on these
instructions to force a transactional abort, since whether they cause
transactional
aborts is implementation dependent.

[...]

- Ring transitions: SYSENTER, SYSCALL, SYSEXIT, and SYSRET.

I suspect that many bits of the kernel expect that things they do
won't unhappen. For example, it could be fun to do:

int devrandom = open("/dev/random", O_RDONLY);
unsigned int abort_code = _xbegin();

if (abort_code & 1) {
printf("Your next random byte is %d\n", (int)(abort_code >> 24));
} else if (abort_code != 0) {
printf("Attack failed\n");
} else {
char r;
read(devrandom, &r, 1);
_xabort(r);
}

[This won't compile because _xabort requires an immediate argument.
Fixing that is easy with assembler tricks.]

So... do all of the syscall entries (and maybe even the page fault
handler) need explicit xabort instructions? Or is the manual (or my
understanding of it) wrong?

(The manual also says that IO instructions and sti might not abort.
That seems surprising.)

--Andy

P.S. Aside from this issue, TSX seems really neat. I can even think
of some single-threaded uses for it.


\
 
 \ /
  Last update: 2012-02-10 08:43    [W:0.042 / U:9.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site