[lkml]   [2023]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRE: the x86 sysret_rip test fails on the Intel FRED architecture
> >> The x86 sysret_rip test has the following assertion:
> >>
> >> /* R11 and EFLAGS should already match. */
> >> assert(ctx->uc_mcontext.gregs[REG_EFL] ==
> >> ctx->uc_mcontext.gregs[REG_R11]);
> >>
> >> This is being tested to avoid kernel state leak due to sysret vs
> >> iret, but that on FRED r11 is *always* preserved, and the test just fails.
> >
> >Let's figure out the reason that FRED acts differently, first. Right
> >now, the SDM says:
> >
> > SYSCALL also saves RFLAGS into R11
> >
> >so that behavior of SYSCALL _looks_ architectural to me. Was this
> >change in SYSCALL behavior with FRED intentional?
> >
> >If not intentional, it might be something that can still be fixed. If
> >it is intentional and is going to be with us for a while we have a few
> >options. If userspace is _really_ depending on this behavior, we could
> >just clobber r11 ourselves in the FRED entry path. If not, we can
> >remove the assertion in the selftest.
> We can't clobber it in the FRED entry path, since it is common for all events, but we
> could do it in the syscall dispatch.

Yes, adding "regs->r11 = regs->flags" in the SYSCALL dispatch does make
the test pass.

> However, it doesn't seem to make sense to do so to me. The current behavior is
> much more of an artifact than desired behavior.

We kind of have an agreement that %r11 = %flags after returning from the kernel.

And the question is, is it what we want?
 \ /
  Last update: 2023-03-26 23:51    [W:0.230 / U:0.904 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site