lkml.org 
[lkml]   [2015]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH urgent] x86, asm: Disable opportunistic SYSRET if regs->flags has TF set
On 04/01/2015 09:25 PM, Andy Lutomirski wrote:
> Fix it by using IRET to restore TF. Since it's late, I'm keeping
> this minimal and keeping "testq" instead of switching to "testl".

Changing to "testl" here wins nothing. Since r11 is used,
REX prefix will be encoded anyway.

>
> - testq $X86_EFLAGS_RF,%r11 /* sysret can't restore RF */
> + /*
> + * SYSRET can't restore RF. SYSRET can restore TF, but unlike IRET,
> + * restoring TF results in a trap from userspace immediately after
> + * SYSRET.

> This would cause an infinite loop whenever #DB happens
> + * with register state that satisfies the opportunistic SYSRET
> + * conditions.
> + */

I propose to just show an example of the affected code:

> This can cause an infinite loop. Example:
> * asm volatile("movq $1f,%rcx\n\t"
> * "pushfq\n\t"
> * "popq %r11\n\t"
> * "nop\n\t"
> * "1:");
> * The above example would get stuck at "1:".
> */





\
 
 \ /
  Last update: 2015-04-01 23:41    [W:0.064 / U:0.404 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site