SlideShare a Scribd company logo
1 of 18
1/18
x86-64 Exceptions: OS Perspective
Konstantin Belousov kib@FreeBSD.org
November 30, 2019, git date: 2019-11-25
(b) label 2Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
2/18
Agenda
Architecture
AMD64 = x86-64 = IA32-64 = IA32e
Introductory half
What is Exception
Exceptions vs. Interrupts
OS Handling of Exceptions
Advanced half
Segments and Segments Cache
Exceptions on return to usermode
POP %SS
VMM Exceptions: VM Exits
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
3/18
What is Exception
Core Loop
CPU core fetches, decodes, and executes instructions.
Speculatively and out-of-order.
Hardware Assists
Helpers used when normal execution fails. Examples:
TLB miss: page table walker
denormals: FPU handlers
If something went bad
If CPU has no way to execute instruction up to spec, it raises
Exception.
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
4/18
What is Exception, cont.
Exception
Non-local control transfer
Synchronous, hw execution context is recoverable
Typically raise the privilege mode, change hw stack
Cannot be masked *
One instruction can cause more than one exception
Not exceptional, in fact very common
Allows control software (OS, VMM) to keep control
Syscalls are not implemented as exceptions for long time
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
5/18
Interrupts
Normal Interrupts
Caused by external events
Asynchronous
Can be delayed (disabled, masked) *
* Non-Maskable Interrupt
Cannot be delayed **
** Except inside NMI handler
IRETQ reenables NMI
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
6/18
OS Handling of Exceptions
Out of scope
How CPU finds an exception handler: IDT, GDT, TSS, etc
Try to handle
Page fault: page-in
Co-processor not available: load HW context, enable FPU
Unsupported instruction: emulate
Cannot handle
Handle == Continue faulted execution
Send synchronous signal to the thread
Terminate the process
Panic the machine
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
7/18
Exceptions and Signals
Signals on Unhandled Exceptions
#PF (Page Fault) SIGSEGV, SIGBUS
#GP (General Protection Fault),
#SS (Stack Fault),
#NP (Segment Not Present),
#AC (Alignment) SIGBUS
#MF (x87 floating-point error),
#XM (SIMD floating point error),
#DE (Divide Exception), SIGFPE
#UD (Invalid Opcode) SIGILL
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
8/18
End of Introductory Part
Questions
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
9/18
x86 Segmentation
Code Properties
Code %cs
Stack %ss
Data %ds %es
Segments Cache
Thread Local Storage (TLS)
User TLS base %fs, base MSR FSBASE
Kernel TLS base (Per-CPU area, PCPU) %gs, two bases:
GSBASE, KGSBASE
SWAPGS
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
10/18
SWAPGS
Kernel Entry
/* interrupts disabled */
if (frame->cs.rpl != 0) /* from user */
SWAPGS;
NMI
Can interrupt code above
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
11/18
Return to Usermode
The last kernel instructions
SWAPGS
IRETQ
...
<Execution continues in user mode>
IRETQ Frame
%ss
%rsp
%rflags
%cs
%rip <- current %rsp
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
12/18
Return to Usermode, cont.
What can go wrong ?
%cs invalid → #np
%ss invalid → #ss
%rip not canonical → #gp
%rsp not canonical → #ss
GPF, Segment, and Stack Fault handlers
User Mode → Signal Delivery
Kernel Mode → Kernel Bug and panic ?
Yes, unless faulted on IRETQ to usermode
Kernel mode, but GSBASE is User, and User page tables (KPTI)
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
13/18
Delaying Exceptions
Stack reload
movq $STACKSEG,%ss
movq $BASE,%rsp /* Intrs and breakpoints delayed */
next instruction /* Pending interrupts delivered */
Exploit
movq $STACKSEG,%ss
syscall <= Set hardware breakpoint there
<KERNEL ENTRY>
swapgs <= Exception occurs there
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
14/18
Delaying Exceptions: diagram
User Code
syscall
entry
#db
handler,
check
prev mode
SWAPGS
#db
handler
body
syscall #db
kerneluser
Exec modes: userspace, kernel
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
15/18
Delaying Exceptions
Coordinated disclosure, MS lead
CVE-2018-8897
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
16/18
VMX Exceptions
VM Exits
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
17/18
End of Second Part
Questions
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
18/18
References
Intel 64 and IA-32 Architectures Software Developer Manuals,
Volume 3
AMD, AMD64 Architecture Programmer’s Manual Volume 2:
System Programming
Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective

More Related Content

Similar to Embedded Fest 2019. Константин Белоусов. Исключения и прерывания на amd64: как ОС управляет компьютером

LCU14 302- How to port OP-TEE to another platform
LCU14 302- How to port OP-TEE to another platformLCU14 302- How to port OP-TEE to another platform
LCU14 302- How to port OP-TEE to another platformLinaro
 
directCell - Cell/B.E. tightly coupled via PCI Express
directCell - Cell/B.E. tightly coupled via PCI ExpressdirectCell - Cell/B.E. tightly coupled via PCI Express
directCell - Cell/B.E. tightly coupled via PCI ExpressHeiko Joerg Schick
 
[Defcon] Hardware backdooring is practical
[Defcon] Hardware backdooring is practical[Defcon] Hardware backdooring is practical
[Defcon] Hardware backdooring is practicalMoabi.com
 
My First AMD EPYC 7251 memo
My First AMD EPYC 7251 memoMy First AMD EPYC 7251 memo
My First AMD EPYC 7251 memoNaoto MATSUMOTO
 
Getting started with LinuxBoot Firmware on AArch64 Server
Getting started with LinuxBoot Firmware on AArch64 Server Getting started with LinuxBoot Firmware on AArch64 Server
Getting started with LinuxBoot Firmware on AArch64 Server Naohiro Tamura
 
Troubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device DriversTroubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device DriversSatpal Parmar
 
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1Jagadisha Maiya
 
JomaSoft VDCF - Solaris Private Cloud
JomaSoft VDCF - Solaris Private CloudJomaSoft VDCF - Solaris Private Cloud
JomaSoft VDCF - Solaris Private CloudJomaSoft
 
bfarm-v2
bfarm-v2bfarm-v2
bfarm-v2Zeus G
 
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...PROIDEA
 
Intel® RDT Hands-on Lab
Intel® RDT Hands-on LabIntel® RDT Hands-on Lab
Intel® RDT Hands-on LabMichelle Holley
 
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio [Unite Seoul 2019] Mali GPU Architecture and Mobile Studio
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio Owen Wu
 
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...ryancox
 
Osa-multi-core.ppt
Osa-multi-core.pptOsa-multi-core.ppt
Osa-multi-core.pptSrikumarTB
 
PV-Drivers for SeaBIOS using Upstream Qemu
PV-Drivers for SeaBIOS using Upstream QemuPV-Drivers for SeaBIOS using Upstream Qemu
PV-Drivers for SeaBIOS using Upstream QemuThe Linux Foundation
 
Hardware backdooring is practical : slides
Hardware backdooring is practical : slidesHardware backdooring is practical : slides
Hardware backdooring is practical : slidesMoabi.com
 

Similar to Embedded Fest 2019. Константин Белоусов. Исключения и прерывания на amd64: как ОС управляет компьютером (20)

LCU14 302- How to port OP-TEE to another platform
LCU14 302- How to port OP-TEE to another platformLCU14 302- How to port OP-TEE to another platform
LCU14 302- How to port OP-TEE to another platform
 
directCell - Cell/B.E. tightly coupled via PCI Express
directCell - Cell/B.E. tightly coupled via PCI ExpressdirectCell - Cell/B.E. tightly coupled via PCI Express
directCell - Cell/B.E. tightly coupled via PCI Express
 
[Defcon] Hardware backdooring is practical
[Defcon] Hardware backdooring is practical[Defcon] Hardware backdooring is practical
[Defcon] Hardware backdooring is practical
 
Genode Compositions
Genode CompositionsGenode Compositions
Genode Compositions
 
My First AMD EPYC 7251 memo
My First AMD EPYC 7251 memoMy First AMD EPYC 7251 memo
My First AMD EPYC 7251 memo
 
Getting started with LinuxBoot Firmware on AArch64 Server
Getting started with LinuxBoot Firmware on AArch64 Server Getting started with LinuxBoot Firmware on AArch64 Server
Getting started with LinuxBoot Firmware on AArch64 Server
 
Troubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device DriversTroubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device Drivers
 
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
 
JomaSoft VDCF - Solaris Private Cloud
JomaSoft VDCF - Solaris Private CloudJomaSoft VDCF - Solaris Private Cloud
JomaSoft VDCF - Solaris Private Cloud
 
The Cell Processor
The Cell ProcessorThe Cell Processor
The Cell Processor
 
bfarm-v2
bfarm-v2bfarm-v2
bfarm-v2
 
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
 
Intel® RDT Hands-on Lab
Intel® RDT Hands-on LabIntel® RDT Hands-on Lab
Intel® RDT Hands-on Lab
 
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio [Unite Seoul 2019] Mali GPU Architecture and Mobile Studio
[Unite Seoul 2019] Mali GPU Architecture and Mobile Studio
 
Basic Linux kernel
Basic Linux kernelBasic Linux kernel
Basic Linux kernel
 
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...
Developing Applications for Beagle Bone Black, Raspberry Pi and SoC Single Bo...
 
My First F-Stack
My First F-StackMy First F-Stack
My First F-Stack
 
Osa-multi-core.ppt
Osa-multi-core.pptOsa-multi-core.ppt
Osa-multi-core.ppt
 
PV-Drivers for SeaBIOS using Upstream Qemu
PV-Drivers for SeaBIOS using Upstream QemuPV-Drivers for SeaBIOS using Upstream Qemu
PV-Drivers for SeaBIOS using Upstream Qemu
 
Hardware backdooring is practical : slides
Hardware backdooring is practical : slidesHardware backdooring is practical : slides
Hardware backdooring is practical : slides
 

More from EmbeddedFest

Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practice
Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practiceEmbedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practice
Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practiceEmbeddedFest
 
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theory
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theoryEmbedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theory
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theoryEmbeddedFest
 
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...EmbeddedFest
 
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hood
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hoodEmbedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hood
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hoodEmbeddedFest
 
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...EmbeddedFest
 
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...EmbeddedFest
 
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to Cloud
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to CloudEmbedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to Cloud
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to CloudEmbeddedFest
 
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...EmbeddedFest
 
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered device
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered deviceEmbedded Fest 2019. Іван Пустовіт. From AOSP to Android powered device
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered deviceEmbeddedFest
 

More from EmbeddedFest (9)

Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practice
Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practiceEmbedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practice
Embedded Fest 2019. Wei Fu. Linux on RISC-V--Fedora and Firmware in practice
 
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theory
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theoryEmbedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theory
Embedded Fest 2019. Руслан Биловол. Linux Boot: The Big Bang theory
 
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...
Embedded Fest 2019. Віталій Нужний. The Mobility Revolution: the Software tha...
 
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hood
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hoodEmbedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hood
Embedded Fest 2019. Игорь Опанюк. Das U-boot v2019: a look under the hood
 
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...
Embedded Fest 2019. Володимир Шанойло. High FIVE: Samsung integrity protectio...
 
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...
Embedded Fest 2019. Dov Nimratz. Artificial Intelligence in Small Embedded Sy...
 
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to Cloud
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to CloudEmbedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to Cloud
Embedded Fest 2019. Антон Волошин. Connected Mobility: from Vehicle to Cloud
 
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...
Embedded Fest 2019. Игорь Таненков и Игорь Успеньев. Action Recognition from ...
 
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered device
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered deviceEmbedded Fest 2019. Іван Пустовіт. From AOSP to Android powered device
Embedded Fest 2019. Іван Пустовіт. From AOSP to Android powered device
 

Recently uploaded

Daily Lesson Plan in Mathematics Quarter 4
Daily Lesson Plan in Mathematics Quarter 4Daily Lesson Plan in Mathematics Quarter 4
Daily Lesson Plan in Mathematics Quarter 4JOYLYNSAMANIEGO
 
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...JojoEDelaCruz
 
week 1 cookery 8 fourth - quarter .pptx
week 1 cookery 8  fourth  -  quarter .pptxweek 1 cookery 8  fourth  -  quarter .pptx
week 1 cookery 8 fourth - quarter .pptxJonalynLegaspi2
 
Keynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designKeynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designMIPLM
 
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdf
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdfGrade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdf
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdfJemuel Francisco
 
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)lakshayb543
 
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfInclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfTechSoup
 
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATION
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATIONTHEORIES OF ORGANIZATION-PUBLIC ADMINISTRATION
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATIONHumphrey A Beña
 
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptx
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptxDIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptx
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptxMichelleTuguinay1
 
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Celine George
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfPatidar M
 
Textual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSTextual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSMae Pangan
 
4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptxmary850239
 
Production of Monoclonal Antibodies by Hybridoma Technology.pptx
Production of Monoclonal Antibodies by Hybridoma Technology.pptxProduction of Monoclonal Antibodies by Hybridoma Technology.pptx
Production of Monoclonal Antibodies by Hybridoma Technology.pptxAnupkumar Sharma
 
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptx
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptxMECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptx
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptxAnupkumar Sharma
 
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfVirtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfErwinPantujan2
 

Recently uploaded (20)

Daily Lesson Plan in Mathematics Quarter 4
Daily Lesson Plan in Mathematics Quarter 4Daily Lesson Plan in Mathematics Quarter 4
Daily Lesson Plan in Mathematics Quarter 4
 
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
 
week 1 cookery 8 fourth - quarter .pptx
week 1 cookery 8  fourth  -  quarter .pptxweek 1 cookery 8  fourth  -  quarter .pptx
week 1 cookery 8 fourth - quarter .pptx
 
Keynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designKeynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-design
 
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdf
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdfGrade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdf
Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdf
 
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
 
INCLUSIVE EDUCATION PRACTICES FOR TEACHERS AND TRAINERS.pptx
INCLUSIVE EDUCATION PRACTICES FOR TEACHERS AND TRAINERS.pptxINCLUSIVE EDUCATION PRACTICES FOR TEACHERS AND TRAINERS.pptx
INCLUSIVE EDUCATION PRACTICES FOR TEACHERS AND TRAINERS.pptx
 
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfInclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
 
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATION
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATIONTHEORIES OF ORGANIZATION-PUBLIC ADMINISTRATION
THEORIES OF ORGANIZATION-PUBLIC ADMINISTRATION
 
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptx
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptxDIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptx
DIFFERENT BASKETRY IN THE PHILIPPINES PPT.pptx
 
YOUVE_GOT_EMAIL_PRELIMS_EL_DORADO_2024.pptx
YOUVE_GOT_EMAIL_PRELIMS_EL_DORADO_2024.pptxYOUVE_GOT_EMAIL_PRELIMS_EL_DORADO_2024.pptx
YOUVE_GOT_EMAIL_PRELIMS_EL_DORADO_2024.pptx
 
Mattingly "AI & Prompt Design: Large Language Models"
Mattingly "AI & Prompt Design: Large Language Models"Mattingly "AI & Prompt Design: Large Language Models"
Mattingly "AI & Prompt Design: Large Language Models"
 
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdf
 
Textual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSTextual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHS
 
4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx
 
Production of Monoclonal Antibodies by Hybridoma Technology.pptx
Production of Monoclonal Antibodies by Hybridoma Technology.pptxProduction of Monoclonal Antibodies by Hybridoma Technology.pptx
Production of Monoclonal Antibodies by Hybridoma Technology.pptx
 
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptx
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptxMECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptx
MECHANISMS OF DIFFERENT TYPES OF HYPERSENITIVITY REACTIONS.pptx
 
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptxLEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
 
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfVirtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
 

Embedded Fest 2019. Константин Белоусов. Исключения и прерывания на amd64: как ОС управляет компьютером

  • 1. 1/18 x86-64 Exceptions: OS Perspective Konstantin Belousov kib@FreeBSD.org November 30, 2019, git date: 2019-11-25 (b) label 2Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 2. 2/18 Agenda Architecture AMD64 = x86-64 = IA32-64 = IA32e Introductory half What is Exception Exceptions vs. Interrupts OS Handling of Exceptions Advanced half Segments and Segments Cache Exceptions on return to usermode POP %SS VMM Exceptions: VM Exits Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 3. 3/18 What is Exception Core Loop CPU core fetches, decodes, and executes instructions. Speculatively and out-of-order. Hardware Assists Helpers used when normal execution fails. Examples: TLB miss: page table walker denormals: FPU handlers If something went bad If CPU has no way to execute instruction up to spec, it raises Exception. Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 4. 4/18 What is Exception, cont. Exception Non-local control transfer Synchronous, hw execution context is recoverable Typically raise the privilege mode, change hw stack Cannot be masked * One instruction can cause more than one exception Not exceptional, in fact very common Allows control software (OS, VMM) to keep control Syscalls are not implemented as exceptions for long time Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 5. 5/18 Interrupts Normal Interrupts Caused by external events Asynchronous Can be delayed (disabled, masked) * * Non-Maskable Interrupt Cannot be delayed ** ** Except inside NMI handler IRETQ reenables NMI Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 6. 6/18 OS Handling of Exceptions Out of scope How CPU finds an exception handler: IDT, GDT, TSS, etc Try to handle Page fault: page-in Co-processor not available: load HW context, enable FPU Unsupported instruction: emulate Cannot handle Handle == Continue faulted execution Send synchronous signal to the thread Terminate the process Panic the machine Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 7. 7/18 Exceptions and Signals Signals on Unhandled Exceptions #PF (Page Fault) SIGSEGV, SIGBUS #GP (General Protection Fault), #SS (Stack Fault), #NP (Segment Not Present), #AC (Alignment) SIGBUS #MF (x87 floating-point error), #XM (SIMD floating point error), #DE (Divide Exception), SIGFPE #UD (Invalid Opcode) SIGILL Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 8. 8/18 End of Introductory Part Questions Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 9. 9/18 x86 Segmentation Code Properties Code %cs Stack %ss Data %ds %es Segments Cache Thread Local Storage (TLS) User TLS base %fs, base MSR FSBASE Kernel TLS base (Per-CPU area, PCPU) %gs, two bases: GSBASE, KGSBASE SWAPGS Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 10. 10/18 SWAPGS Kernel Entry /* interrupts disabled */ if (frame->cs.rpl != 0) /* from user */ SWAPGS; NMI Can interrupt code above Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 11. 11/18 Return to Usermode The last kernel instructions SWAPGS IRETQ ... <Execution continues in user mode> IRETQ Frame %ss %rsp %rflags %cs %rip <- current %rsp Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 12. 12/18 Return to Usermode, cont. What can go wrong ? %cs invalid → #np %ss invalid → #ss %rip not canonical → #gp %rsp not canonical → #ss GPF, Segment, and Stack Fault handlers User Mode → Signal Delivery Kernel Mode → Kernel Bug and panic ? Yes, unless faulted on IRETQ to usermode Kernel mode, but GSBASE is User, and User page tables (KPTI) Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 13. 13/18 Delaying Exceptions Stack reload movq $STACKSEG,%ss movq $BASE,%rsp /* Intrs and breakpoints delayed */ next instruction /* Pending interrupts delivered */ Exploit movq $STACKSEG,%ss syscall <= Set hardware breakpoint there <KERNEL ENTRY> swapgs <= Exception occurs there Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 14. 14/18 Delaying Exceptions: diagram User Code syscall entry #db handler, check prev mode SWAPGS #db handler body syscall #db kerneluser Exec modes: userspace, kernel Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 15. 15/18 Delaying Exceptions Coordinated disclosure, MS lead CVE-2018-8897 Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 16. 16/18 VMX Exceptions VM Exits Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 17. 17/18 End of Second Part Questions Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective
  • 18. 18/18 References Intel 64 and IA-32 Architectures Software Developer Manuals, Volume 3 AMD, AMD64 Architecture Programmer’s Manual Volume 2: System Programming Konstantin Belousov kib@FreeBSD.org x86-64 Exceptions: OS Perspective