From: tip-bot for Andy Lutomirski <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: tglx@linutronix.de, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, frederic@kernel.org, bp@suse.de,
peterz@infradead.org, torvalds@linux-foundation.org,
mingo@kernel.org, jcm@redhat.com, hpa@zytor.com, luto@kernel.org
Subject: [tip:x86/urgent] x86/speculation/mds: Revert CPU buffer clear on double fault exit
Date: Thu, 16 May 2019 00:10:21 -0700 [thread overview]
Message-ID: <tip-88640e1dcd089879530a49a8d212d1814678dfe7@git.kernel.org> (raw)
In-Reply-To: <ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org>
Commit-ID: 88640e1dcd089879530a49a8d212d1814678dfe7
Gitweb: https://git.kernel.org/tip/88640e1dcd089879530a49a8d212d1814678dfe7
Author: Andy Lutomirski <luto@kernel.org>
AuthorDate: Tue, 14 May 2019 13:24:39 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Thu, 16 May 2019 09:05:11 +0200
x86/speculation/mds: Revert CPU buffer clear on double fault exit
The double fault ESPFIX path doesn't return to user mode at all --
it returns back to the kernel by simulating a #GP fault.
prepare_exit_to_usermode() will run on the way out of
general_protection before running user code.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jon Masters <jcm@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")
Link: http://lkml.kernel.org/r/ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
Documentation/x86/mds.rst | 7 -------
arch/x86/kernel/traps.c | 8 --------
2 files changed, 15 deletions(-)
diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst
index 534e9baa4e1d..0dc812bb9249 100644
--- a/Documentation/x86/mds.rst
+++ b/Documentation/x86/mds.rst
@@ -158,13 +158,6 @@ Mitigation points
mitigated on the return from do_nmi() to provide almost complete
coverage.
- - Double fault (#DF):
-
- A double fault is usually fatal, but the ESPFIX workaround, which can
- be triggered from user space through modify_ldt(2) is a recoverable
- double fault. #DF uses the paranoid exit path, so explicit mitigation
- in the double fault handler is required.
-
- Machine Check Exception (#MC):
Another corner case is a #MC which hits between the CPU buffer clear
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 7de466eb960b..8b6d03e55d2f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -58,7 +58,6 @@
#include <asm/alternative.h>
#include <asm/fpu/xstate.h>
#include <asm/trace/mpx.h>
-#include <asm/nospec-branch.h>
#include <asm/mpx.h>
#include <asm/vm86.h>
#include <asm/umip.h>
@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
regs->ip = (unsigned long)general_protection;
regs->sp = (unsigned long)&gpregs->orig_ax;
- /*
- * This situation can be triggered by userspace via
- * modify_ldt(2) and the return does not take the regular
- * user space exit, so a CPU buffer clear is required when
- * MDS mitigation is enabled.
- */
- mds_user_clear_cpu_buffers();
return;
}
#endif
next prev parent reply other threads:[~2019-05-16 7:10 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-14 20:24 [PATCH 0/2] x86/speculation/mds: Minor fixes Andy Lutomirski
2019-05-14 20:24 ` [PATCH 1/2] x86/speculation/mds: Revert CPU buffer clear on double fault exit Andy Lutomirski
2019-05-16 7:10 ` tip-bot for Andy Lutomirski [this message]
2019-05-14 20:24 ` [PATCH 2/2] x86/speculation/mds: Improve CPU buffer clear documentation Andy Lutomirski
2019-05-16 7:11 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=tip-88640e1dcd089879530a49a8d212d1814678dfe7@git.kernel.org \
--to=tipbot@zytor.com \
--cc=bp@suse.de \
--cc=frederic@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=jcm@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).