diff options
| author | Andy Lutomirski <luto@kernel.org> | 2019-05-14 13:24:39 -0700 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2019-05-16 09:05:11 +0200 |
| commit | 88640e1dcd089879530a49a8d212d1814678dfe7 (patch) | |
| tree | b3bfb6be2d0f41cef5c8d3b7797f55e70e510c61 /Documentation/x86 | |
| parent | 00f5764dbb040188e5dce2cd9e648360886b045c (diff) | |
| download | linux-88640e1dcd089879530a49a8d212d1814678dfe7.tar.bz2 | |
x86/speculation/mds: Revert CPU buffer clear on double fault exit
The double fault ESPFIX path doesn't return to user mode at all --
it returns back to the kernel by simulating a #GP fault.
prepare_exit_to_usermode() will run on the way out of
general_protection before running user code.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jon Masters <jcm@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")
Link: http://lkml.kernel.org/r/ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'Documentation/x86')
| -rw-r--r-- | Documentation/x86/mds.rst | 7 |
1 files changed, 0 insertions, 7 deletions
diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst index 534e9baa4e1d..0dc812bb9249 100644 --- a/Documentation/x86/mds.rst +++ b/Documentation/x86/mds.rst @@ -158,13 +158,6 @@ Mitigation points mitigated on the return from do_nmi() to provide almost complete coverage. - - Double fault (#DF): - - A double fault is usually fatal, but the ESPFIX workaround, which can - be triggered from user space through modify_ldt(2) is a recoverable - double fault. #DF uses the paranoid exit path, so explicit mitigation - in the double fault handler is required. - - Machine Check Exception (#MC): Another corner case is a #MC which hits between the CPU buffer clear |