Re: X86: Question about GDT loading

[Christian Ludloff]

>> It is intended. Slot 0 in the GDT is not used, so it is a pretty common
>> convention to stuff the pointer to the GDT itself into that slot.
>>
>> For 32 bits that is perfectly safe. On 64 bits, it ends up taking up slot 1 as
>> well; this is *not* safe for a kernel address as it would be interpreted as a
>> user-space code descriptor for a single-byte code segment somewhere in the low
>> 16 MB of memory, addressable as 0x13:0. This could be used to derive bits
>> [55:32] of the kernel GDT base from user space.
>
> Corrected: addressable as 0xb:0.
>
>> Therefore this must NOT be done in 64-bit mode.
>
> Formally speaking: long mode.

A mixed-mode GDT can safely place a task gate descriptor
at GDT offset 8 though, because the first two bytes of it are
reserved/ignored (in legacy mode) and because task gates
are no longer used/supported (in long mode).

    https://www.sandpile.org/x86/desc.htm

So the technique still works... if GDTR base [63:32] is zero;
else two copies of the GDT end up being used (assuming a
LGDT in legacy mode, then a mode switch, then a LGDT in
long mode again [to load the upper base bits]).

The technique itself does go back at least to the early '90s:

    https://www.rcollins.org/Productivity/NullDescriptor.html

--
C.