Messages in this thread | | | From | Andy Lutomirski <> | Date | Thu, 30 Jul 2015 22:11:40 -0700 | Subject | Re: Dealing with the NMI mess |
| |
On Thu, Jul 30, 2015 at 9:22 PM, Borislav Petkov <bp@alien8.de> wrote: > On Thu, Jul 30, 2015 at 02:22:06PM -0700, Andy Lutomirski wrote: >> Great. There's an opcode that invokes an interrupt gate that's not >> marked as allowing unprivileged access, and that opcode doesn't appear >> in the SDM. It appears in the APM opcode map with no explanation at >> all. >> >> Thanks, CPU vendors. > > Here's something better: > > http://www.rcollins.org/secrets/opcodes/ICEBP.html
This instruction is awesome. Binutils can disassemble it (it's called "icebp") but it can't assemble it. KVM has special handling for it on VMX and actually reports it to QEMU on SVM (complete with a defined ABI). We have an asm macro so we can assemble it for 32-bit but not 64-bit, despite the fact that it works on 64-bit.
The kernel instruction decoder can't decode it.
Fortunately, it looks like the vm86 case is correct (or as correct as any of the vm86 junk can be), although I haven't tested it. I bet that icebp is like int3 in that it punches through vm86 mode instead of sending #GP.
--Andy
| |