On Wed, Apr 23, 2014 at 10:16 AM, H. Peter Anvin <h...@zytor.com> wrote: > On 04/23/2014 10:08 AM, Andrew Lutomirski wrote: >> >> The only way I can see to trigger the race is with sigreturn, but it's >> still there. Sigh. >> > > I don't see why sigreturn needs to be involved... all you need is > modify_ldt() on one CPU while the other is in the middle of an IRET > return. Small window, so hard to hit, but still. >
If you set the flag as soon as anyone calls modify_ldt, before any descriptor is installed, then I don't think this can happen. But there's still sigreturn, and I don't think this is worth all the complexity to save a single branch on #GP. >> 2. I've often pondered changing the way we return *to* CPL 0 to bypass >> iret entirely. It could be something like: >> >> SS >> RSP >> EFLAGS >> CS >> RIP >> >> push 16($rsp) >> popfq [does this need to force rex.w somehow?] >> ret $64 > > When you say return to CPL 0 you mean intra-kernel return? That isn't > really the problem here, though. I think this will also break the > kernel debugger since it will have the wrong behavior for TF and RF. I do mean intra-kernel. And yes, this has nothing to do with espfix, but it would make write_msr_safe fail more quickly :) --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
