x86/speculation/mds: Minor fixes

PATCH New Andy Lutomirski 2 participants 5 messages May 14, 2019 – May 16, 2019

Subsystems (3)

Stable branch Documentation x86

lore

Share & tools

lore

Andy Lutomirski

author

2019-05-14 20:25 UTC #0 lore raw

cover x86/speculation/mds: Minor fixes

The first I heard of MDS was today. Let's fix the problems I noticed right away.

Andy Lutomirski (2):
x86/speculation/mds: Revert CPU buffer clear on double fault exit x86/speculation/mds: Improve CPU buffer clear documentation

 Documentation/x86/mds.rst | 44 ++++++---------------------------------
 arch/x86/kernel/traps.c   |  8 -------
 2 files changed, 6 insertions(+), 46 deletions(-)

Signature · 1 line

2.21.0

Andy Lutomirski

author

2019-05-14 20:25 UTC #1 lore raw

PATCH 1/2 x86/speculation/mds: Revert CPU buffer clear on double fault exit

The double fault ESPFIX path doesn't return to user mode at all -- it returns back to the kernel by simulating a #GP fault. prepare_exit_to_usermode() will run on the way out of general_protection before running user code.

Cc [email protected]

Cc Greg Kroah-Hartman <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Frederic Weisbecker <[email protected]>

Cc Jon Masters <[email protected]>

Fixes 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")

Signed-off-by Andy Lutomirski <[email protected]>

---
 Documentation/x86/mds.rst | 7 -------
 arch/x86/kernel/traps.c   | 8 --------
 2 files changed, 15 deletions(-)

Documentation/x86/mds.rst +0 -7

index 534e9baa4e1d..0dc812bb9249 100644
@@ -158,13 +158,6 @@ Mitigation points
      mitigated on the return from do_nmi() to provide almost complete
      coverage.
 
-   - Double fault (#DF):
-
-     A double fault is usually fatal, but the ESPFIX workaround, which can
-     be triggered from user space through modify_ldt(2) is a recoverable
-     double fault. #DF uses the paranoid exit path, so explicit mitigation
-     in the double fault handler is required.
-
    - Machine Check Exception (#MC):
 
      Another corner case is a #MC which hits between the CPU buffer clear

arch/x86/kernel/traps.c +0 -8

index 7de466eb960b..8b6d03e55d2f 100644
@@ -58,7 +58,6 @@
 #include <asm/alternative.h>
 #include <asm/fpu/xstate.h>
 #include <asm/trace/mpx.h>
-#include <asm/nospec-branch.h>
 #include <asm/mpx.h>
 #include <asm/vm86.h>
 #include <asm/umip.h>

@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
 		regs->ip = (unsigned long)general_protection;
 		regs->sp = (unsigned long)&gpregs->orig_ax;
 
-		/*
-		 * This situation can be triggered by userspace via
-		 * modify_ldt(2) and the return does not take the regular
-		 * user space exit, so a CPU buffer clear is required when
-		 * MDS mitigation is enabled.
-		 */
-		mds_user_clear_cpu_buffers();
 		return;
 	}
 #endif

Signature · 1 line

2.21.0

tip-bot for Andy Lutomirski

merge bot

2019-05-16 07:10 UTC #2 lore raw

[tip:x86/urgent] x86/speculation/mds: Revert CPU buffer clear on double fault exit

x86/speculation/mds: Revert CPU buffer clear on double fault exit

Commit-ID:  88640e1dcd089879530a49a8d212d1814678dfe7
Gitweb:     https://git.kernel.org/tip/88640e1dcd089879530a49a8d212d1814678dfe7
Author:     Andy Lutomirski <[email protected]>
AuthorDate: Tue, 14 May 2019 13:24:39 -0700
Committer:  Ingo Molnar <[email protected]>
CommitDate: Thu, 16 May 2019 09:05:11 +0200

x86/speculation/mds: Revert CPU buffer clear on double fault exit

Signed-off-by Andy Lutomirski <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Frederic Weisbecker <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc Jon Masters <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc [email protected]

Fixes 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")

Link http://lkml.kernel.org/r/ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org open here

Signed-off-by Ingo Molnar <[email protected]>

---
 Documentation/x86/mds.rst | 7 -------
 arch/x86/kernel/traps.c   | 8 --------
 2 files changed, 15 deletions(-)

Documentation/x86/mds.rst +0 -7

index 534e9baa4e1d..0dc812bb9249 100644
@@ -158,13 +158,6 @@ Mitigation points
      mitigated on the return from do_nmi() to provide almost complete
      coverage.
 
-   - Double fault (#DF):
-
-     A double fault is usually fatal, but the ESPFIX workaround, which can
-     be triggered from user space through modify_ldt(2) is a recoverable
-     double fault. #DF uses the paranoid exit path, so explicit mitigation
-     in the double fault handler is required.
-
    - Machine Check Exception (#MC):
 
      Another corner case is a #MC which hits between the CPU buffer clear

arch/x86/kernel/traps.c +0 -8

index 7de466eb960b..8b6d03e55d2f 100644
@@ -58,7 +58,6 @@
 #include <asm/alternative.h>
 #include <asm/fpu/xstate.h>
 #include <asm/trace/mpx.h>
-#include <asm/nospec-branch.h>
 #include <asm/mpx.h>
 #include <asm/vm86.h>
 #include <asm/umip.h>

@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
 		regs->ip = (unsigned long)general_protection;
 		regs->sp = (unsigned long)&gpregs->orig_ax;
 
-		/*
-		 * This situation can be triggered by userspace via
-		 * modify_ldt(2) and the return does not take the regular
-		 * user space exit, so a CPU buffer clear is required when
-		 * MDS mitigation is enabled.
-		 */
-		mds_user_clear_cpu_buffers();
 		return;
 	}
 #endif

Andy Lutomirski

author

2019-05-14 20:25 UTC #3 lore raw

PATCH 2/2 x86/speculation/mds: Improve CPU buffer clear documentation

In reply to Andy Lutomirski

On x86_64, all returns to usermode go through prepare_exit_to_usermode(), with the sole exception of do_nmi(). This even includes machine checks -- this was added several years ago to support MCE recovery. Update the documentation.

Cc [email protected]

Cc Greg Kroah-Hartman <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Frederic Weisbecker <[email protected]>

Cc Jon Masters <[email protected]>

Fixes 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")

Signed-off-by Andy Lutomirski <[email protected]>

---
 Documentation/x86/mds.rst | 39 +++++++--------------------------------
 1 file changed, 7 insertions(+), 32 deletions(-)

Documentation/x86/mds.rst +7 ~~-32~~

index 0dc812bb9249..5d4330be200f 100644
@@ -142,38 +142,13 @@ Mitigation points
    mds_user_clear.
 
    The mitigation is invoked in prepare_exit_to_usermode() which covers
-   most of the kernel to user space transitions. There are a few exceptions
-   which are not invoking prepare_exit_to_usermode() on return to user
-   space. These exceptions use the paranoid exit code.
-
-   - Non Maskable Interrupt (NMI):
-
-     Access to sensible data like keys, credentials in the NMI context is
-     mostly theoretical: The CPU can do prefetching or execute a
-     misspeculated code path and thereby fetching data which might end up
-     leaking through a buffer.
-
-     But for mounting other attacks the kernel stack address of the task is
-     already valuable information. So in full mitigation mode, the NMI is
-     mitigated on the return from do_nmi() to provide almost complete
-     coverage.
-
-   - Machine Check Exception (#MC):
-
-     Another corner case is a #MC which hits between the CPU buffer clear
-     invocation and the actual return to user. As this still is in kernel
-     space it takes the paranoid exit path which does not clear the CPU
-     buffers. So the #MC handler repopulates the buffers to some
-     extent. Machine checks are not reliably controllable and the window is
-     extremly small so mitigation would just tick a checkbox that this
-     theoretical corner case is covered. To keep the amount of special
-     cases small, ignore #MC.
-
-   - Debug Exception (#DB):
-
-     This takes the paranoid exit path only when the INT1 breakpoint is in
-     kernel space. #DB on a user space address takes the regular exit path,
-     so no extra mitigation required.
+   all but one of the kernel to user space transitions.  The exception
+   is when we return from a Non Maskable Interrupt (NMI), which is
+   handled directly in do_nmi().
+
+   (The reason that NMI is special is that prepare_exit_to_usermode() can
+    enable IRQs.  In NMI context, NMIs are blocked, and we don't want to
+    enable IRQs with NMIs blocked.)
 
 
 2. C-State transition

Signature · 1 line

2.21.0

tip-bot for Andy Lutomirski

merge bot

2019-05-16 07:11 UTC #4 lore raw

[tip:x86/urgent] x86/speculation/mds: Improve CPU buffer clear documentation

x86/speculation/mds: Improve CPU buffer clear documentation

Commit-ID:  9d8d0294e78a164d407133dea05caf4b84247d6a
Gitweb:     https://git.kernel.org/tip/9d8d0294e78a164d407133dea05caf4b84247d6a
Author:     Andy Lutomirski <[email protected]>
AuthorDate: Tue, 14 May 2019 13:24:40 -0700
Committer:  Ingo Molnar <[email protected]>
CommitDate: Thu, 16 May 2019 09:05:12 +0200

x86/speculation/mds: Improve CPU buffer clear documentation

Signed-off-by Andy Lutomirski <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Frederic Weisbecker <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc Jon Masters <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc [email protected]

Fixes 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")

Link http://lkml.kernel.org/r/999fa9e126ba6a48e9d214d2f18dbde5c62ac55c.1557865329.git.luto@kernel.org open here

Signed-off-by Ingo Molnar <[email protected]>

---
 Documentation/x86/mds.rst | 39 +++++++--------------------------------
 1 file changed, 7 insertions(+), 32 deletions(-)

Documentation/x86/mds.rst +7 ~~-32~~

index 0dc812bb9249..5d4330be200f 100644
@@ -142,38 +142,13 @@ Mitigation points
    mds_user_clear.
 
    The mitigation is invoked in prepare_exit_to_usermode() which covers
-   most of the kernel to user space transitions. There are a few exceptions
-   which are not invoking prepare_exit_to_usermode() on return to user
-   space. These exceptions use the paranoid exit code.
-
-   - Non Maskable Interrupt (NMI):
-
-     Access to sensible data like keys, credentials in the NMI context is
-     mostly theoretical: The CPU can do prefetching or execute a
-     misspeculated code path and thereby fetching data which might end up
-     leaking through a buffer.
-
-     But for mounting other attacks the kernel stack address of the task is
-     already valuable information. So in full mitigation mode, the NMI is
-     mitigated on the return from do_nmi() to provide almost complete
-     coverage.
-
-   - Machine Check Exception (#MC):
-
-     Another corner case is a #MC which hits between the CPU buffer clear
-     invocation and the actual return to user. As this still is in kernel
-     space it takes the paranoid exit path which does not clear the CPU
-     buffers. So the #MC handler repopulates the buffers to some
-     extent. Machine checks are not reliably controllable and the window is
-     extremly small so mitigation would just tick a checkbox that this
-     theoretical corner case is covered. To keep the amount of special
-     cases small, ignore #MC.
-
-   - Debug Exception (#DB):
-
-     This takes the paranoid exit path only when the INT1 breakpoint is in
-     kernel space. #DB on a user space address takes the regular exit path,
-     so no extra mitigation required.
+   all but one of the kernel to user space transitions.  The exception
+   is when we return from a Non Maskable Interrupt (NMI), which is
+   handled directly in do_nmi().
+
+   (The reason that NMI is special is that prepare_exit_to_usermode() can
+    enable IRQs.  In NMI context, NMIs are blocked, and we don't want to
+    enable IRQs with NMIs blocked.)
 
 
 2. C-State transition