Adrian Danis cca128ead9 ia32: Always use IRET instead of sysexit when single stepping ... Previous code to return to user level performed popf sysexit The popf was just before the sysexit as there is a one instruction delay on the trap flag taking effect and ensured we did not attempt to single step the kernel. Unfortunately there is not a one instruction delay on enabling the interrupt flag, and as a result an interrupt can be taken prior to executing the sysexit instruction. It is possible to exploit this to escalate a user level thread such that it is running with CPL0 This commit changes the restore paths to perform sti sysexit Which will correctly delay interrupts until the completion of sysexit. As the popf is now being done earlier to prevent single stepping the kernel we return via an iret, instead of sysexit, for threads that have single stepping enabled. To achieve this we * When loading debug state if we enable the Trap flag we also manipulate the register state such that the iret return path will be picked * As fastpath_restore does not have an iret return path we forbid the fastpath from switching to threads that have single stepping enabled		2017-01-05 16:49:19 +11:00
..
arm	[STYLE_FIX]	2017-01-04 22:57:29 +00:00
x86/arch	ia32: Always use IRET instead of sysexit when single stepping	2017-01-05 16:49:19 +11:00