linux-kernel - Re: [PATCH] do not keep interrupt window closed by sti in real mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 8 Apr 2009 11:55:45 -0300
From:	Glauber Costa <glommer@...hat.com>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	kvm@...r.kernel.org, linux-kernel@...r.kernel.org, avi@...hat.com
Subject: Re: [PATCH] do not keep interrupt window closed by sti in real mode

On Tue, Apr 07, 2009 at 09:14:58PM -0700, H. Peter Anvin wrote:
> Glauber Costa wrote:
> > While in real mode, sti does not block interrupts from the subsequent
> > instruction. This is stated at Intel SDM Volume 2b, page 4-432
> 
> I don't see how you're getting that idea from the STI documentation --
> and I am quite sure that that is not the case.  Quite on the contrary.
> The only differences between protected mode and real mode has to do with
> the handling of VIF when CPL=3 (this rather naturally falls out if one
> considers CPL=0 in real mode).
> 
> The text is:
> 
> "If protected-mode virtual interrupts are not enabled, STI sets the
> interrupt flag (IF) in the EFLAGS register. After the IF flag is set,
> the processor begins responding to external, maskable interrupts after
> the next instruction is executed. The delayed effect of this instruction
> is provided to allow interrupts to be enabled just before returning from
> a procedure (or subroutine). For instance, if an STI instruction is
> followed by an RET instruction, the RET instruction is allowed to
> execute before external interrupts are recognized1. If the STI
> instruction is followed by a CLI instruction (which clears the IF flag),
> the effect of the STI instruction is negated."
> 
> Obviously, in real mode, "protected-mode virtual interrupts" are not
> enabled, as is also confirmed by Table 4-5.

I get the idea from the pseudocode in sti description.
It says:
IF PE = 0 (* Executing in real-address mode *)
    THEN
        IF <- 1; (* Set Interrupt Flag *)
    ELSE (* Executing in protected mode or virtual-8086 mode *)

There is no mention to any other activity besides setting the if flag.
Also, sti is used extensively in many places like the linux kernel for the
guest, and it works just fine in kvm. So I was led to believe that real mode
in fact behaving differently.

I'll take a look at avi's suggestion.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/