3 ms·
At first I thought this was an error in implementing new docs related to Meltdown/Spectre. But the original research paper: https://everdox.net/popss.pdf http
by LeifCarrotson 9y ago
At first I thought this was an error in implementing new docs related to Meltdown/Spectre. But the original research paper:
https://everdox.net/popss.pdf https://everdox.net/popss.pdf
the researcher wrote:
> Somewhere around the release of the 8086, Intel decided to add a special caveat to instructions loading the SS register...where loading SS with [`pop ss` or `move ss`] would force the processor to disable external interrupts, NMIs, and pending debug exceptions.
So it's a really, really old piece of documentation, dating from around 1980.
To call it a 'misinterpretation' rather than a vulnerability is extremely generous, given that most Intel engineers spent entire careers in the presence of code vulnerable to this 'misinterpretation' without calling the OS vendors out on their error.
- ianopolous 9y agoOn this particular thing I think the Intel docs are clear. This is where I implemented the same in JPC: https://github.com/ianopolous/JPC/blob/master/src/org/jpc/emulator/execution/decoder/Disassembler.java#L351 https://github.com/ianopolous/JPC/blob/master/src/org/jpc/em...
- an_account_name 9y agoThey might be clear today. Were they always? There are literally decades of timeline to examine here.
- ianopolous 9y agoThey were clear in 2006 when I was reading them. All the emulator implementors were very aware of it. Many old operating systems won't boot without the delay.
- caf 9y agoThe interrupt shadow itself is clear. The specific implication of that for a mov ss ; syscall pair with a hardware breakpoint set on the first instruction is a lot more subtle.
- ianopolous 8y agoAgreed, but that's just saying that combining two or more simple things results in a more complex thing. All platforms I know of describe each individual instruction and its consequences, and leave you to deduce the consequences of combining them.