Re: [PATCH] x86-64: espfix for 64-bit mode *PROTOTYPE*

H. Peter Anvin
2014-04-23T17:29:05Z

On 04/23/2014 10:25 AM, Andrew Lutomirski wrote:
> On Wed, Apr 23, 2014 at 10:16 AM, H. Peter Anvin <hpa@zytor.com> wrote:
>> On 04/23/2014 10:08 AM, Andrew Lutomirski wrote:
>>>
>>> The only way I can see to trigger the race is with sigreturn, but it's
>>> still there. Sigh.
>>
>> I don't see why sigreturn needs to be involved... all you need is
>> modify_ldt() on one CPU while the other is in the middle of an IRET
>> return. Small window, so hard to hit, but still.
>
> If you set the flag as soon as anyone calls modify_ldt, before any
> descriptor is installed, then I don't think this can happen. But
> there's still sigreturn, and I don't think this is worth all the
> complexity to save a single branch on #GP.
>

Who cares? Since we only need to enter the fixup path for LDT
selectors, anything that is dependent on having called modify_ldt() is
already redundant.

In some ways that is the saving grace. SS being an LDT selector is
fortunately a rare case.

> I do mean intra-kernel. And yes, this has nothing to do with espfix,
> but it would make write_msr_safe fail more quickly :)

And, pray tell, how important is that?

-hpa