lkml.org 
[lkml]   [2019]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v8 13/17] x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation
    Date
    From: Tony Luck <tony.luck@intel.com>

    Before enabling FSGSBASE the kernel could safely assume that the content
    of GS base was a user address. Thus any speculative access as the result
    of a mispredicted branch controlling the execution of SWAPGS would be to
    a user address. So systems with speculation-proof SMAP did not need to
    add additional LFENCE instructions to mitigate.

    With FSGSBASE enabled a hostile user can set GS base to a kernel address.
    So they can make the kernel speculatively access data they wish to leak
    via a side channel. This means that SMAP provides no protection.

    Add FSGSBASE as an additional condition to enable the fence-based SWAPGS
    mitigation.

    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    ---

    Changes from v7:
    * Included as a new patch.
    ---
    arch/x86/kernel/cpu/bugs.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
    index 91c2561..e06356f 100644
    --- a/arch/x86/kernel/cpu/bugs.c
    +++ b/arch/x86/kernel/cpu/bugs.c
    @@ -321,14 +321,12 @@ static void __init spectre_v1_select_mitigation(void)
    * If FSGSBASE is enabled, the user can put a kernel address in
    * GS, in which case SMAP provides no protection.
    *
    - * [ NOTE: Don't check for X86_FEATURE_FSGSBASE until the
    - * FSGSBASE enablement patches have been merged. ]
    - *
    * If FSGSBASE is disabled, the user can only put a user space
    * address in GS. That makes an attack harder, but still
    * possible if there's no SMAP protection.
    */
    - if (!smap_works_speculatively()) {
    + if (boot_cpu_has(X86_FEATURE_FSGSBASE) ||
    + !smap_works_speculatively()) {
    /*
    * Mitigation can be provided from SWAPGS itself or
    * PTI as the CR3 write in the Meltdown mitigation
    --
    2.7.4
    \
     
     \ /
      Last update: 2019-09-12 22:09    [W:2.785 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site