flat assembler
Message board for the users of flat assembler.

Index > OS Construction > syscall/sysret stack

Author
Thread Post new topic Reply to topic
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
while executing syscall, where does kernel get its stack?

int use TSS, sysenter use IA32_SYSENTER_ESP, what about syscall?
does the stack isnt switched, and im executing on userland stack while cpl = 0?
or TSS is used?

i think (since you load a selector in IA32_STAR[47:32]), stack pointer isnt changed at all, but access is made through kernel segment. but if its right, why bother with IA32_STAR[47:32]? just reload CS and stack stays, ehh.

any suggestions?
Post 16 Feb 2010, 18:54
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
asmmsa wrote:
i think (since you load a selector in IA32_STAR[47:32]), stack pointer isnt changed at all…
Almost true. syscall loads next selector (remember "IA32_STAR_MSR[47:32]+8"?) into ss, modifying [shadow] descriptor to be flat (0+4GiB) R/W expand-up segment with DPL==0. It's a fast switch, kernel code ends up with same esp as syscaller (probably pointing into probably flat caller's stack segment).
Post 16 Feb 2010, 20:56
View user's profile Send private message Reply with quote
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
hmmm.. so i can deallocate stack while kernel is accessing it?
i can do that from cpl = 3, os will page fault in cpl = 0, and thats not good i guess?

or kernel before accessing arguments must use something like MmProbeAndLockPages() on stack (create mdl first ofc), then access it?
Also i can pass sensitive read only address (there is that in windows, containing systemroot path, ticks and other stuff)?


syscall/sysret are newer than sysenter/sysexit, are they better? how to handle stack (no)switch? And how does it know the size of allocation, or limit? i can do whatever i want.
Post 16 Feb 2010, 21:53
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
asmmsa wrote:
hmmm.. so i can deallocate stack while kernel is accessing it?
How're you supposed to do that while you don't have control? SMP? Race condition.

Locked pages are entirely another issue.

syscall is just as it is, fast transfer to ring 0 without excessive checks.

When in doubt, RTFM. I'll collaborate, but only in constructive cases, OK?
Post 16 Feb 2010, 22:56
View user's profile Send private message Reply with quote
smiddy



Joined: 31 Oct 2004
Posts: 559
smiddy
!rolling
Post 16 Feb 2010, 23:52
View user's profile Send private message Reply with quote
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
ive found about swapgs instruction, wich can be used to replace GS base with address of data.


ok, what about preemption?
thread execute syscall, swapgs, and gets preempted?
MSR holding kernel struct is swapped with propably 0 from GS, and next thread will want to swapgs = what?

or maybe context switching also save this msr?
Post 17 Feb 2010, 11:03
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17278
Location: In your JS exploiting you and your system
revolution
asmmsa: Preemption is controlled by the OS. It is not an automatic hardware function. If the OS wants to run another task then it switches when it is ready.
Post 17 Feb 2010, 11:53
View user's profile Send private message Visit poster's website Reply with quote
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
ok but how context scheduler knows, when GS was swapped, and when it wasnt?

when for example timer interrupt fires, this scheduler checks if thread has any time left, and if it does not have, its switched. And when its switched, MSR of GS is not saved or changed, wich leads to my question.

does syscall/sysret work on multitasking os or not?
Post 17 Feb 2010, 19:35
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17278
Location: In your JS exploiting you and your system
revolution
asmmsa wrote:
does syscall/sysret work on multitasking os or not?
Well it has been used in Windows and Linux for many years now. So I think it is safe to answer yes.
Post 18 Feb 2010, 02:07
View user's profile Send private message Visit poster's website Reply with quote
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
linux pass arguments in registers so its nor really a problem.
windows use stack, so what about it?

swapgs cant be used to get pointer to kernel stack because it destroy MSR holding gs base.


you dont know, right? maybe syscall/sysret are not designed to support stack switching? if so, they suck badly and i wonder why they are used. sysenter/sysexit are way better.
Post 18 Feb 2010, 09:45
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17278
Location: In your JS exploiting you and your system
revolution
Just compare the value in GS to see if you have the kernel value or some other value. This is not supposed to be a problem when writing an OS and the syscall/sysret can absolutely 100% support all type of multitasking and stack switching in any way you want to implement it. You just have to use them properly.
Post 18 Feb 2010, 09:51
View user's profile Send private message Visit poster's website Reply with quote
asmmsa



Joined: 06 Feb 2010
Posts: 45
asmmsa
so, before making task switch, i must check if my GS base is = predefined kernel value, and if it is, execute swapgs and save somewere information that gs was swapped. when switching to new task, read this information and if set, swapgs.
Post 18 Feb 2010, 10:01
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17278
Location: In your JS exploiting you and your system
revolution
It just depends upon how you write your OS kernel. Without knowledge of your code no one else can say what will work for you in you code.
Post 18 Feb 2010, 10:17
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.