On Thu, Apr 23, 2015 at 2:37 PM, H. Peter Anvin <h...@zytor.com> wrote: > On 04/23/2015 02:10 PM, Borislav Petkov wrote: >> On Thu, Apr 23, 2015 at 10:01:16PM +0200, Denys Vlasenko wrote: >>> Naturally, CS can't be NULL, and up until today >>> I thought SS also can't. But the bit is probably implemented >>> for all eight cached descriptors. >> >> There's this section about NULL selector in APM v2. It says that NULL >> selectors are used to invalidate segment registers and software can load >> a NULL selector in SS in CPL0. >> >> So, if an interrupt happens and as you quoted earlier that SS gets set >> to NULL as a result of an interrupt, there's that SS leak causing the SS >> exception. >> > > Yes, the NULL SS is a special thing in 64-bit mode. I agree that > context-switching it is probably the way to go; it should be cheap > enough. We might even be able to conditionalize it on an X86_BUG_ flag.
I still don't see why context switches are a better place than just before sysret, but I could be convinced. I updated my test at https://git.kernel.org/cgit/linux/kernel/git/luto/misc-tests.git/. I want to figure out whether this is a problem for sysretq, too. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
