Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

[Xin Li]

On 11/20/2024 1:33 AM, Andrew Cooper wrote:
> > The first GDT descriptor is reserved as 'null descriptor'.  As bits 0
> > and 1 of a segment selector, i.e., the DPL bits, are NOT used to index
>
> That's RPL in segment selector, not DPL.  Same correction is needed in
> the code comments.

Intel SDM says:

• Descriptor privilege level (DPL) field —
  (Bits 13 and 14 in the second doubleword of a segment descriptor.)
  Determines the privilege level of the segment.
• Requested privilege level (RPL) field —
  (Bits 0 and 1 of any segment selector.) Specifies the requested
  privilege level of a segment selector.

I got lost somehow.

> > GDT, selector values 0~3 all point to the null descriptor, thus values
> > 0, 1, 2 and 3 are all valid null selector values.
> >
> > Furthermore IRET zeros ES, FS, GS, and DS segment registers if any of
> > them is found to have any null selector value, essentially making 0 a
> > preferred null selector value.
>
> Zeroing of RPL in null selectors is an information leak in pre-FRED
> systems.  Userspace can spot any interrupt/exception by loading a
> nonzero NULL selector, and waiting for it to drop to zero.
>
> Userspace should not be able to do this; Andy and I lobbied for this
> during the design of FRED, and Intel agreed.

I wasn't aware of this, and hpa just told me you're right :)

> Right now, this change is codifying the problem behaviour we were trying
> to fix out under FRED.
>
> Under FRED, if userspace loads e.g. 2 into a selector, it should remain
> 2 until userspace changes it to something else.

Okay, I will fix it by:
1) For null selector values, do nothing.
2) For non-null selector values, set RPL bits.

sounds okay?

Thanks!
    Xin