Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

[Xin Li <xin@zytor.com>]

On 11/20/2024 1:33 AM, Andrew Cooper wrote:
>> The first GDT descriptor is reserved as 'null descriptor'.  As bits 0
>> and 1 of a segment selector, i.e., the DPL bits, are NOT used to index
> 
> That's RPL in segment selector, not DPL.  Same correction is needed in
> the code comments.

Intel SDM says:

• Descriptor privilege level (DPL) field —
   (Bits 13 and 14 in the second doubleword of a segment descriptor.)
   Determines the privilege level of the segment.
• Requested privilege level (RPL) field —
   (Bits 0 and 1 of any segment selector.) Specifies the requested
   privilege level of a segment selector.

I got lost somehow.

> 
>> GDT, selector values 0~3 all point to the null descriptor, thus values
>> 0, 1, 2 and 3 are all valid null selector values.
>>
>> Furthermore IRET zeros ES, FS, GS, and DS segment registers if any of
>> them is found to have any null selector value, essentially making 0 a
>> preferred null selector value.
> 
> Zeroing of RPL in null selectors is an information leak in pre-FRED
> systems.  Userspace can spot any interrupt/exception by loading a
> nonzero NULL selector, and waiting for it to drop to zero.
> 
> Userspace should not be able to do this; Andy and I lobbied for this
> during the design of FRED, and Intel agreed.

I wasn't aware of this, and hpa just told me you're right :)

> 
> Right now, this change is codifying the problem behaviour we were trying
> to fix out under FRED.
> 
> Under FRED, if userspace loads e.g. 2 into a selector, it should remain
> 2 until userspace changes it to something else.

Okay, I will fix it by:
1) For null selector values, do nothing.
2) For non-null selector values, set RPL bits.

sounds okay?

Thanks!
     Xin