* [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
@ 2018-07-22 18:05 Andy Lutomirski
2018-07-23 7:25 ` Greg KH
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Andy Lutomirski @ 2018-07-22 18:05 UTC (permalink / raw)
To: x86, LKML
Cc: Borislav Petkov, Linus Torvalds, Dave Hansen, Greg KH,
Andy Lutomirski, Brian Gerst, Dominik Brodowski, Ingo Molnar,
H. Peter Anvin, Thomas Gleixner, Boris Ostrovsky, Juergen Gross,
xen-devel, stable
error_entry and error_exit communicate the user vs kernel status of
the frame using %ebx. This is unnecessary -- the information is in
regs->cs. Just use regs->cs.
This makes error_entry simpler and makes error_exit more robust.
It also fixes a nasty bug. Before all the Spectre nonsense, The
xen_failsafe_callback entry point returned like this:
ALLOC_PT_GPREGS_ON_STACK
SAVE_C_REGS
SAVE_EXTRA_REGS
ENCODE_FRAME_POINTER
jmp error_exit
And it did not go through error_entry. This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used. As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks. Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes. This was introduced by:
commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
exceptions/interrupts, to reduce speculation attack surface")
With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.
I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.
[Historical note: I wrote this patch as a cleanup before I was aware
of the bug it fixed.]
[Note to stable maintainers: this should probably get applied to all
kernels. If you're nervous about that, a more conservative fix to
add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
also fix the problem.]
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: xen-devel@lists.xenproject.org
Cc: x86@kernel.org
Cc: stable@vger.kernel.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
I could also submit the conservative fix tagged for -stable and respin
this on top of it. Ingo, Greg, what do you prefer?
arch/x86/entry/entry_64.S | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
+ jmp error_exit
.endif
END(\sym)
.endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
/*
* Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
*/
ENTRY(error_entry)
UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
* for these here too.
*/
.Lerror_kernelspace:
- incl %ebx
leaq native_irq_return_iret(%rip), %rcx
cmpq %rcx, RIP+8(%rsp)
je .Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
/*
* Pretend that the exception came from user mode: set up pt_regs
- * as if we faulted immediately after IRET and clear EBX so that
- * error_exit knows that we will be returning to user mode.
+ * as if we faulted immediately after IRET.
*/
mov %rsp, %rdi
call fixup_bad_iret
mov %rax, %rsp
- decl %ebx
jmp .Lerror_entry_from_usermode_after_swapgs
END(error_entry)
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- * 1: already in kernel mode, don't need SWAPGS
- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
ENTRY(error_exit)
UNWIND_HINT_REGS
DISABLE_INTERRUPTS(CLBR_ANY)
TRACE_IRQS_OFF
- testl %ebx, %ebx
- jnz retint_kernel
+ testb $3, CS(%rsp)
+ jz retint_kernel
jmp retint_user
END(error_exit)
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
@ 2018-07-23 7:25 ` Greg KH
2018-07-24 2:31 ` Andy Lutomirski
2018-07-24 2:31 ` Andy Lutomirski
2018-07-23 7:25 ` Greg KH
2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
2 siblings, 2 replies; 6+ messages in thread
From: Greg KH @ 2018-07-23 7:25 UTC (permalink / raw)
To: Andy Lutomirski
Cc: x86, LKML, Borislav Petkov, Linus Torvalds, Dave Hansen,
Brian Gerst, Dominik Brodowski, Ingo Molnar, H. Peter Anvin,
Thomas Gleixner, Boris Ostrovsky, Juergen Gross, xen-devel,
stable
On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
> error_entry and error_exit communicate the user vs kernel status of
> the frame using %ebx. This is unnecessary -- the information is in
> regs->cs. Just use regs->cs.
>
> This makes error_entry simpler and makes error_exit more robust.
>
> It also fixes a nasty bug. Before all the Spectre nonsense, The
> xen_failsafe_callback entry point returned like this:
>
> ALLOC_PT_GPREGS_ON_STACK
> SAVE_C_REGS
> SAVE_EXTRA_REGS
> ENCODE_FRAME_POINTER
> jmp error_exit
>
> And it did not go through error_entry. This was bogus: RBX
> contained garbage, and error_exit expected a flag in RBX.
> Fortunately, it generally contained *nonzero* garbage, so the
> correct code path was used. As part of the Spectre fixes, code was
> added to clear RBX to mitigate certain speculation attacks. Now,
> depending on kernel configuration, RBX got zeroed and, when running
> some Wine workloads, the kernel crashes. This was introduced by:
>
> commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
> exceptions/interrupts, to reduce speculation attack surface")
>
> With this patch applied, RBX is no longer needed as a flag, and the
> problem goes away.
>
> I suspect that malicious userspace could use this bug to crash the
> kernel even without the offending patch applied, though.
>
> [Historical note: I wrote this patch as a cleanup before I was aware
> of the bug it fixed.]
>
> [Note to stable maintainers: this should probably get applied to all
> kernels. If you're nervous about that, a more conservative fix to
> add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
> also fix the problem.]
>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: xen-devel@lists.xenproject.org
> Cc: x86@kernel.org
> Cc: stable@vger.kernel.org
> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
>
> I could also submit the conservative fix tagged for -stable and respin
> this on top of it. Ingo, Greg, what do you prefer?
I don't care, this patch looks good to me to take as-is for the stable
trees. If you trust it in Linus's tree, it should be fine for others :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
2018-07-23 7:25 ` Greg KH
@ 2018-07-23 7:25 ` Greg KH
2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
2 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2018-07-23 7:25 UTC (permalink / raw)
To: Andy Lutomirski
Cc: Juergen Gross, Dave Hansen, Brian Gerst, x86, LKML,
Dominik Brodowski, Ingo Molnar, Borislav Petkov, stable,
H. Peter Anvin, xen-devel, Thomas Gleixner, Linus Torvalds,
Boris Ostrovsky
On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
> error_entry and error_exit communicate the user vs kernel status of
> the frame using %ebx. This is unnecessary -- the information is in
> regs->cs. Just use regs->cs.
>
> This makes error_entry simpler and makes error_exit more robust.
>
> It also fixes a nasty bug. Before all the Spectre nonsense, The
> xen_failsafe_callback entry point returned like this:
>
> ALLOC_PT_GPREGS_ON_STACK
> SAVE_C_REGS
> SAVE_EXTRA_REGS
> ENCODE_FRAME_POINTER
> jmp error_exit
>
> And it did not go through error_entry. This was bogus: RBX
> contained garbage, and error_exit expected a flag in RBX.
> Fortunately, it generally contained *nonzero* garbage, so the
> correct code path was used. As part of the Spectre fixes, code was
> added to clear RBX to mitigate certain speculation attacks. Now,
> depending on kernel configuration, RBX got zeroed and, when running
> some Wine workloads, the kernel crashes. This was introduced by:
>
> commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
> exceptions/interrupts, to reduce speculation attack surface")
>
> With this patch applied, RBX is no longer needed as a flag, and the
> problem goes away.
>
> I suspect that malicious userspace could use this bug to crash the
> kernel even without the offending patch applied, though.
>
> [Historical note: I wrote this patch as a cleanup before I was aware
> of the bug it fixed.]
>
> [Note to stable maintainers: this should probably get applied to all
> kernels. If you're nervous about that, a more conservative fix to
> add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
> also fix the problem.]
>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: xen-devel@lists.xenproject.org
> Cc: x86@kernel.org
> Cc: stable@vger.kernel.org
> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
>
> I could also submit the conservative fix tagged for -stable and respin
> this on top of it. Ingo, Greg, what do you prefer?
I don't care, this patch looks good to me to take as-is for the stable
trees. If you trust it in Linus's tree, it should be fine for others :)
thanks,
greg k-h
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-07-23 7:25 ` Greg KH
2018-07-24 2:31 ` Andy Lutomirski
@ 2018-07-24 2:31 ` Andy Lutomirski
1 sibling, 0 replies; 6+ messages in thread
From: Andy Lutomirski @ 2018-07-24 2:31 UTC (permalink / raw)
To: Greg KH
Cc: Andy Lutomirski, X86 ML, LKML, Borislav Petkov, Linus Torvalds,
Dave Hansen, Brian Gerst, Dominik Brodowski, Ingo Molnar,
H. Peter Anvin, Thomas Gleixner, Boris Ostrovsky, Juergen Gross,
xen-devel, stable
On Mon, Jul 23, 2018 at 12:25 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
>> error_entry and error_exit communicate the user vs kernel status of
>> the frame using %ebx. This is unnecessary -- the information is in
>> regs->cs. Just use regs->cs.
>>
>> This makes error_entry simpler and makes error_exit more robust.
>>
>> It also fixes a nasty bug. Before all the Spectre nonsense, The
>> xen_failsafe_callback entry point returned like this:
>>
>> ALLOC_PT_GPREGS_ON_STACK
>> SAVE_C_REGS
>> SAVE_EXTRA_REGS
>> ENCODE_FRAME_POINTER
>> jmp error_exit
>>
>> And it did not go through error_entry. This was bogus: RBX
>> contained garbage, and error_exit expected a flag in RBX.
>> Fortunately, it generally contained *nonzero* garbage, so the
>> correct code path was used. As part of the Spectre fixes, code was
>> added to clear RBX to mitigate certain speculation attacks. Now,
>> depending on kernel configuration, RBX got zeroed and, when running
>> some Wine workloads, the kernel crashes. This was introduced by:
>>
>> commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>> exceptions/interrupts, to reduce speculation attack surface")
>>
>> With this patch applied, RBX is no longer needed as a flag, and the
>> problem goes away.
>>
>> I suspect that malicious userspace could use this bug to crash the
>> kernel even without the offending patch applied, though.
>>
>> [Historical note: I wrote this patch as a cleanup before I was aware
>> of the bug it fixed.]
>>
>> [Note to stable maintainers: this should probably get applied to all
>> kernels. If you're nervous about that, a more conservative fix to
>> add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>> also fix the problem.]
>>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: xen-devel@lists.xenproject.org
>> Cc: x86@kernel.org
>> Cc: stable@vger.kernel.org
>> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
>> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> ---
>>
>> I could also submit the conservative fix tagged for -stable and respin
>> this on top of it. Ingo, Greg, what do you prefer?
>
> I don't care, this patch looks good to me to take as-is for the stable
> trees. If you trust it in Linus's tree, it should be fine for others :)
>
My concern is more that something may work differently in older
kernels and there might be some subtle issue. I'd be surprised, but
still.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-07-23 7:25 ` Greg KH
@ 2018-07-24 2:31 ` Andy Lutomirski
2018-07-24 2:31 ` Andy Lutomirski
1 sibling, 0 replies; 6+ messages in thread
From: Andy Lutomirski @ 2018-07-24 2:31 UTC (permalink / raw)
To: Greg KH
Cc: Juergen Gross, X86 ML, Brian Gerst, Dave Hansen, LKML,
Dominik Brodowski, Ingo Molnar, Borislav Petkov, stable,
Andy Lutomirski, H. Peter Anvin, xen-devel, Thomas Gleixner,
Linus Torvalds, Boris Ostrovsky
On Mon, Jul 23, 2018 at 12:25 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
>> error_entry and error_exit communicate the user vs kernel status of
>> the frame using %ebx. This is unnecessary -- the information is in
>> regs->cs. Just use regs->cs.
>>
>> This makes error_entry simpler and makes error_exit more robust.
>>
>> It also fixes a nasty bug. Before all the Spectre nonsense, The
>> xen_failsafe_callback entry point returned like this:
>>
>> ALLOC_PT_GPREGS_ON_STACK
>> SAVE_C_REGS
>> SAVE_EXTRA_REGS
>> ENCODE_FRAME_POINTER
>> jmp error_exit
>>
>> And it did not go through error_entry. This was bogus: RBX
>> contained garbage, and error_exit expected a flag in RBX.
>> Fortunately, it generally contained *nonzero* garbage, so the
>> correct code path was used. As part of the Spectre fixes, code was
>> added to clear RBX to mitigate certain speculation attacks. Now,
>> depending on kernel configuration, RBX got zeroed and, when running
>> some Wine workloads, the kernel crashes. This was introduced by:
>>
>> commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>> exceptions/interrupts, to reduce speculation attack surface")
>>
>> With this patch applied, RBX is no longer needed as a flag, and the
>> problem goes away.
>>
>> I suspect that malicious userspace could use this bug to crash the
>> kernel even without the offending patch applied, though.
>>
>> [Historical note: I wrote this patch as a cleanup before I was aware
>> of the bug it fixed.]
>>
>> [Note to stable maintainers: this should probably get applied to all
>> kernels. If you're nervous about that, a more conservative fix to
>> add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>> also fix the problem.]
>>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: xen-devel@lists.xenproject.org
>> Cc: x86@kernel.org
>> Cc: stable@vger.kernel.org
>> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
>> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> ---
>>
>> I could also submit the conservative fix tagged for -stable and respin
>> this on top of it. Ingo, Greg, what do you prefer?
>
> I don't care, this patch looks good to me to take as-is for the stable
> trees. If you trust it in Linus's tree, it should be fine for others :)
>
My concern is more that something may work differently in older
kernels and there might be some subtle issue. I'd be surprised, but
still.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip:x86/urgent] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
2018-07-23 7:25 ` Greg KH
2018-07-23 7:25 ` Greg KH
@ 2018-07-24 15:03 ` tip-bot for Andy Lutomirski
2 siblings, 0 replies; 6+ messages in thread
From: tip-bot for Andy Lutomirski @ 2018-07-24 15:03 UTC (permalink / raw)
To: linux-tip-commits
Cc: gregkh, jgross, mingo, luto, tglx, linux, torvalds, jpoimboe,
boris.ostrovsky, peterz, hpa, bp, linux-kernel, dave.hansen,
brgerst, dvlasenk, m.v.b
Commit-ID: b3681dd548d06deb2e1573890829dff4b15abf46
Gitweb: https://git.kernel.org/tip/b3681dd548d06deb2e1573890829dff4b15abf46
Author: Andy Lutomirski <luto@kernel.org>
AuthorDate: Sun, 22 Jul 2018 11:05:09 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 24 Jul 2018 10:07:36 +0200
x86/entry/64: Remove %ebx handling from error_entry/exit
error_entry and error_exit communicate the user vs. kernel status of
the frame using %ebx. This is unnecessary -- the information is in
regs->cs. Just use regs->cs.
This makes error_entry simpler and makes error_exit more robust.
It also fixes a nasty bug. Before all the Spectre nonsense, the
xen_failsafe_callback entry point returned like this:
ALLOC_PT_GPREGS_ON_STACK
SAVE_C_REGS
SAVE_EXTRA_REGS
ENCODE_FRAME_POINTER
jmp error_exit
And it did not go through error_entry. This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used. As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks. Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes. This was introduced by:
commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.
I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.
[ Historical note: I wrote this patch as a cleanup before I was aware
of the bug it fixed. ]
[ Note to stable maintainers: this should probably get applied to all
kernels. If you're nervous about that, a more conservative fix to
add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
also fix the problem. ]
Reported-and-tested-by: M. Vefa Bicakci <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/entry/entry_64.S | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
+ jmp error_exit
.endif
END(\sym)
.endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
/*
* Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
*/
ENTRY(error_entry)
UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
* for these here too.
*/
.Lerror_kernelspace:
- incl %ebx
leaq native_irq_return_iret(%rip), %rcx
cmpq %rcx, RIP+8(%rsp)
je .Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
/*
* Pretend that the exception came from user mode: set up pt_regs
- * as if we faulted immediately after IRET and clear EBX so that
- * error_exit knows that we will be returning to user mode.
+ * as if we faulted immediately after IRET.
*/
mov %rsp, %rdi
call fixup_bad_iret
mov %rax, %rsp
- decl %ebx
jmp .Lerror_entry_from_usermode_after_swapgs
END(error_entry)
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- * 1: already in kernel mode, don't need SWAPGS
- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
ENTRY(error_exit)
UNWIND_HINT_REGS
DISABLE_INTERRUPTS(CLBR_ANY)
TRACE_IRQS_OFF
- testl %ebx, %ebx
- jnz retint_kernel
+ testb $3, CS(%rsp)
+ jz retint_kernel
jmp retint_user
END(error_exit)
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-07-24 15:04 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
2018-07-23 7:25 ` Greg KH
2018-07-24 2:31 ` Andy Lutomirski
2018-07-24 2:31 ` Andy Lutomirski
2018-07-23 7:25 ` Greg KH
2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.