linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* What exactly do 32-bit x86 exceptions push on the stack in the CS slot?
@ 2016-11-20  1:52 Andy Lutomirski
  2016-11-20  2:11 ` Brian Gerst
  2016-11-21  4:54 ` hpa
  0 siblings, 2 replies; 16+ messages in thread
From: Andy Lutomirski @ 2016-11-20  1:52 UTC (permalink / raw)
  To: tedheadster, Linus Torvalds, H. Peter Anvin, Brian Gerst,
	George Spelvin, linux-kernel, X86 ML

This is a question for the old-timers here, since I can't find
anything resembling an answer in the SDM.

Suppose an exception happens (#UD in this case, but I assume it
doesn't really matter).  We're not in long mode, and the IDT is set up
to deliver to a normal 32-bit kernel code segment.  We're running in
that very same code segment when the exception hits, so no CPL change
occurs and the TSS doesn't particularly matter.

The CPU will push EFLAGS, CS, and RIP.  Here's the question: what
happens to the high word of CS on the stack?

The SDM appears to say nothing at all about this.  Modern systems
(e.g. my laptop running in 32-bit legacy mode under KVM) appear to
zero-extend CS.  But Matthew's 486DX appears to put garbage in the
high bits (or maybe just leave whatever was already on the stack in
place).

Do any of you happen to know what's going on and when the behavior
changed?  I'd like to know just how big of a problem this is.  Because
if lots of CPUs work like Matthew's, we have lots of subtle bugs on
them.

--Andy

^ permalink raw reply	[flat|nested] 16+ messages in thread

end of thread, other threads:[~2016-11-24 17:17 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-20  1:52 What exactly do 32-bit x86 exceptions push on the stack in the CS slot? Andy Lutomirski
2016-11-20  2:11 ` Brian Gerst
2016-11-20  2:15   ` Andy Lutomirski
2016-11-21  7:13     ` Ingo Molnar
2016-11-21 18:00       ` Linus Torvalds
2016-11-21 18:26         ` H. Peter Anvin
2016-11-21 21:21           ` Linus Torvalds
2016-11-21 22:17             ` hpa
2016-11-21 22:25               ` Linus Torvalds
2016-11-24 17:16             ` Andy Lutomirski
2016-11-22  8:30         ` Ingo Molnar
2016-11-22 17:30           ` Andy Lutomirski
2016-11-23  8:57             ` Ingo Molnar
2016-11-21  4:54 ` hpa
2016-11-21 15:58   ` H. Peter Anvin
2016-11-21 18:20     ` Linus Torvalds

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).