On Fri, Jul 24, 2015 at 10:10 AM, Willy Tarreau <w...@1wt.eu> wrote: > On Fri, Jul 24, 2015 at 08:48:57AM -0700, Andy Lutomirski wrote: >> So by the time we detect that we've hit a watchpoint, the instruction >> that tripped it is done and we don't need RF. Furthermore, after >> reading 17.3.1.1: I *think* that regs->flags withh have RF *clear* if >> we hit a watchpoint. So this might be as simple as: >> >> if ((dr6 && (0xf * DR_TRAP0) && (regs->flags & (X86_EFLAGS_RF | >> X86_EFLAGS_IF)) == X86_EFLAGS_RF && !user_mode(regs)) >> for (i = 0; i < 4; i++) >> if (dr6 & (DR_TRAP0<<i)) { >> /* hit a kernel breakpoint with IF clear */ >> dr7 &= ~(DR_GLOBAL_ENABLE << (i * DR_ENABLE_SHIFT)); >> } >> >> I'm not saying that your code is wrong, but I think this is simpler >> and avoids poking at yet more per-cpu state from NMI context, which is >> kind of nice. >> >> If you don't like the RF games above, it would also be straightforward >> to parse dr0..dr3 for each DR_TRAP bit that's set and see if it's a >> breakpoint. > > Andy, section 5.8 of the SDM makes me think we could possibly abuse SYSRET > to emulate IRET, and then possibly simplify the flags processing. It says > that it takes the CPL3 code segment but nowhere it says that the target is > validated for effectively being userland, and further it suggests that it > doesn't validate anything : > > "It is the responsibility of the OS to ensure the descriptors in > the GDT/LDT correspond to the selectors loaded by SYSCALL/SYSRET > (consistent with the base, limit, and attribute values forced by > the instructions)."
You are an evil bastard. I seriously doubt that this will work. SYSRET goes to CPL3 no matter what. Also, I don't think you want to start poking at MSRs to return. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/