PCR 8003 - SAS: Corrupted DS can cause kernel to halt
Summary: SAS: Corrupted DS can cause kernel to halt
Status: NEW
Alias: None
Product: Kernel
Classification: Deos
Component: Kernel (show other PCRs)
Version: mainline
Hardware: X86 Deos
: Hold
: Limitation
Target Milestone: 7.6.1
Assignee: .Kernel
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2012-12-19 12:05 MST by rroffelsen
Modified: 2025-12-21 13:15 MST (History)
5 users (show)

See Also:
Impact Assessment: Trivial
Organization: DDC-I, Inc.
deosbugs.ccb: Requirements-
deosbugs.ccb: Code-
deosbugs.ccb: TestCases-
deosbugs.ccb: TestProcedures-
rroffelsen: Other+


Attachments

Note You need to log in before you can comment on or make changes to this PCR.
Description rroffelsen 2012-12-19 12:05:09 MST
+++ This PCR was initially created as a clone of PCR #7994 +++

This limitation only applies to the x86 architecture.  If a thread
loads the DS (data segment) register, and before any other instruction
references the data segment a floating point instruction is executed
that triggers a deferred floating point context switch the kernel will
halt.  Note that most instructions that reference memory implicitly
reference the data segment.  Compiler generated code does not set
segment registers.

Analysis:

The FP and SIMD floating point context switch IDT raw handlers do not
set the data segment register prior to executing instructions that
implicitly reference the data segment register.  On a trap into the
kernel, the interrupt/exception management hardware sets the stack
segment selector, but not the data segment selectors.  Kernel DDD
requirement DDD_DEOS_X86CPU_110 requires that all traps reload the DS
register.  The other IDT raw handlers (exception, interrupt, and
rawServicesTrapHandler all set all the segment registers, but that
requirement was missed when implementing the deferred floating point
context switch raw handlers. 

Workaround:

Because the compiler does not inject code that updates the DS register it is simplest to ensure code does not modify the DS register.  The following instructions can update the DS register:
 - lds
 - mov 
 - pop

The following bash command can be used to check if an executable, shared library, or dll modifies the DS register.

objdump -d kernel.exe | grep -e "\(mov .*%ds\)\|\(pop.*ds\)\|\(lds \)"

If a file that updates the DS register is found the next step is to ensure that there is an instruction that accesses (reads or writes) the data segment prior to any floating point instruction.
Comment 1 deosbugs.ccb 2012-12-20 13:04:35 MST
CCB visited this PCR on 2012-12-20.
Comment 2 deosbugs.ccb 2013-01-03 13:01:28 MST
CCB visited this PCR on 2013-01-03.
Comment 3 deosbugs.ccb 2013-02-12 21:16:44 MST
CCB visited this PCR on 2013-02-12
Comment 4 deosbugs.ccb 2014-05-20 10:15:43 MST
CCB 2 visited this PCR on 2014-05-20
Comment 5 Stephen P. Smith 2016-08-05 12:51:43 MST
Thes SAS has not been updated for this limitation.
Comment 6 G. Craig Johnson 2016-09-18 17:31:49 MST
SAS update checked into subversion as part of revision 51557.
Comment 7 deosbugs.ccb 2016-09-19 13:28:43 MST
CCB visited this PCR on 2016-09-19.
Comment 8 deosbugs.ccb 2016-09-19 13:35:34 MST
PCR 8003 and PCR 8139 were done in a single commit.
Comment 9 deosbugs.ccb 2017-02-01 09:36:53 MST
CCB visited this PCR on 2017-02-01-59501
Comment 10 deosbugs.ccb 2017-10-30 12:21:13 MST
CCB visited this PCR on 2017-10-30-67574
Comment 11 deosbugs.ccb 2018-12-05 10:50:40 MST
CCB visited this PCR on 2018-12-05-63532
Comment 12 Stephen P. Smith 2020-01-16 21:24:11 MST
DDC-I owns this SAS
Comment 13 deosbugs.ccb 2025-12-21 13:14:46 MST
PCR is being updated to permanently on HOLD for limitation documented in the SAS.