lkml.org 
[lkml]   [2019]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 001/241] x86/speculation/mds: Revert CPU buffer clear on double fault exit
    Date
    From: Andy Lutomirski <luto@kernel.org>

    commit 88640e1dcd089879530a49a8d212d1814678dfe7 upstream.

    The double fault ESPFIX path doesn't return to user mode at all --
    it returns back to the kernel by simulating a #GP fault.
    prepare_exit_to_usermode() will run on the way out of
    general_protection before running user code.

    Signed-off-by: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Frederic Weisbecker <frederic@kernel.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Jon Masters <jcm@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Fixes: 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")
    Link: http://lkml.kernel.org/r/ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    Documentation/x86/mds.rst | 7 -------
    arch/x86/kernel/traps.c | 8 --------
    2 files changed, 15 deletions(-)

    --- a/Documentation/x86/mds.rst
    +++ b/Documentation/x86/mds.rst
    @@ -158,13 +158,6 @@ Mitigation points
    mitigated on the return from do_nmi() to provide almost complete
    coverage.

    - - Double fault (#DF):
    -
    - A double fault is usually fatal, but the ESPFIX workaround, which can
    - be triggered from user space through modify_ldt(2) is a recoverable
    - double fault. #DF uses the paranoid exit path, so explicit mitigation
    - in the double fault handler is required.
    -
    - Machine Check Exception (#MC):

    Another corner case is a #MC which hits between the CPU buffer clear
    --- a/arch/x86/kernel/traps.c
    +++ b/arch/x86/kernel/traps.c
    @@ -61,7 +61,6 @@
    #include <asm/alternative.h>
    #include <asm/fpu/xstate.h>
    #include <asm/trace/mpx.h>
    -#include <asm/nospec-branch.h>
    #include <asm/mpx.h>
    #include <asm/vm86.h>

    @@ -338,13 +337,6 @@ dotraplinkage void do_double_fault(struc
    regs->ip = (unsigned long)general_protection;
    regs->sp = (unsigned long)&normal_regs->orig_ax;

    - /*
    - * This situation can be triggered by userspace via
    - * modify_ldt(2) and the return does not take the regular
    - * user space exit, so a CPU buffer clear is required when
    - * MDS mitigation is enabled.
    - */
    - mds_user_clear_cpu_buffers();
    return;
    }
    #endif

    \
     
     \ /
      Last update: 2019-06-09 18:56    [W:4.105 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site