8 ms·
There are many more. It would be difficult to enumerate them all. Nearly anything that causes an exception is easy. Examples: The 0xf1 byte, an "icebp" or "int
by burfog 7y ago
There are many more. It would be difficult to enumerate them all. Nearly anything that causes an exception is easy. Examples:
The 0xf1 byte, an "icebp" or "int1" instruction
In 32-bit code, use an FPU stack underflow
In 64-bit mode, access a non-canonical address
In 32-bit code, use the "into" instruction
Write data using a segment selector that goes beyond the LDT limit
With the alignment checking enabled, do a misaligned memory operation
Of course, we can also do system calls without causing exceptions. Examples:
Write the system call number to a well-known memory location that the OS will poll
Modulate the CPU temperature by running code. The OS decodes the signal. Use message passing that involves OFDM, LDPC, ASN.1, and digital signatures.
- etaioinshrdlu 7y ago> Modulate the CPU temperature by running code. The OS decodes the signal. Use message passing that involves OFDM, LDPC, ASN.1, and digital signatures. I like how you mixed this in with real suggestions.
- kragen 7y agoIt's an excellent suggestion if the code you're trying to communicate with is not actually the kernel, but rather other code on the machine that the kernel is attempting to prevent you from communicating with. Except for the ASN.1 part. That's never a good idea.
- waterhouse 7y agoOr code not on the machine. I remember: "PowerHammer: Exfiltrating Data from Air-Gapped Computers Through Power Lines" https://news.ycombinator.com/item?id=16821513 https://news.ycombinator.com/item?id=16821513
- EGreg 7y agohttps://www.themarysue.com/ibm-black-team/amp/ https://www.themarysue.com/ibm-black-team/amp/
- SAI_Peregrinus 7y ago> Except for the ASN.1 part. That's never a good idea. Don't kink-shame the ITU-T! They're just sadomasochistic, that's all...
- int_19h 7y agoFinally, a perfect application for INTERCAL.
- dfox 7y agoNothing from that list is sane i386 syscall mechanism :). (Which given the fact that the list contains undocumented and obscure 0xf1 icebp and not documented 0xcc int3 seems to be the intention)
- kccqzy 7y agoI'd do an integer division by zero. The syscall number would be the dividend, and zero is the divisor.
- DonHopkins 7y agoAn elegant, brilliant idea. What could possibly go wrong? ;) How about floating point division by zero? Then you could use floating point syscall numbers! SWOON Call it the NaNix kernel. "To infinity, and beyond!!!"
- bicolao 7y ago> What could possibly go wrong? ;) It's not a bug, it's a feature. This adds.. ehem.. a new dimension to integer numbers (or even complex numbers, we'll call them supercomplex numbers).
- yason 7y agoBrilliant! For example, something like 180.7 could then be understood by the kernel to "userland wants to call 70% open and 30% unlink" in one go!
- rrmm 7y agoYou could probably build an academic career on "fractional interpolation of parameterized system calls".
- davedx 7y agoQuantum computing supremacy!
- DonHopkins 7y agoQuantum Objects: Maybe that's what "Quajects" in Alexia Massalin’s Synthesis Kernel actually represent! http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.29.4871&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.29.... p. 51: Chapter 4, Kernel Structure All things should be made as simple as possible, but no simpler. -Albert Einstein 4.1 Quajects Quajects are the building blocks out of which all Synthesis kernel services are composed. The name is derived from the term "object" of Object-Oriented (O-O) systems, which they strongly resemble [32]. The similarity is strong, but the difference is significant. Like objects, quajects encapsulate data and provide a well-defined interface to access it. Unlike objects, quajects use a code-synthesis implementation to achieve high performance, but lack high-level language support and inheritance. Kernel quajects can be broadly classified into four kinds: thread, memory, I/O, and device. Thread quajects encapsulate the unit of execution, memory quajects the unit of data storage, I/O quajects the unit of data movement, and device quajects the machine's interfaces to the outside world. Each kind of quaject is defined and implemented independently.
- fredoralive 7y agoIs PC-AT style "get the keyboard controller to reset the CPU, then have special BIOS code detect situation and jump to your code?" still available in modern systems? Real mode is sortof a supervisor mode. Of course you would have to make the KBC low level accessible to user mode which may cause issue processing legacy input devices. Plus having to reinitialise protected mode every system call might cause some efficiency issues.
- dfox 7y agoIIRC enough of the KBC is still present that this might actually work, another question is whether modern UEFI firmware actually handles the SW-induced reboot. As for entering and exiting protected mode: that is in fact surprisingly fast operation assuming that all the relevant data structures are still in place. In fact DOS XMS managers (and VxD-based Windows) switch between PM with vm86, true real mode and various unreal-ish (ie. real mode with weird values in descriptor shadow registers) modes quite regularly.
- Hello71 7y agoactually, Linux uses at least two of these: for security reasons (ASLR), the vsyscall page is implemented on modern kernels by unmapping the page, trapping the page fault, and emulating the system call. the recently introduced io_uring interface provides an interface to set up a buffer ring which is asynchronously polled by the kernel for system calls to execute.
- Hello71 7y agooh, and of course if you count the vdso as "making a syscall", then three: page fault, polling, and reverse polling.