2022-07-13 21:04:02

by Alexandre Chartre

Subject: [PATCH] x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt

UNTRAIN_RET is not needed in native_irq_return_ldt because ret untrain
has already be done at this point. In addition, when the RETBleed
mitigation is IBPB, UNTRAIN_RET clobbers several registers (AX, CX, DX)
so here it trashes user values which are in these registers.

Signed-off-by: Alexandre Chartre <[email protected]>
---
arch/x86/entry/entry_64.S | 1 -
1 file changed, 1 deletion(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 285e043a3e40..9953d966d124 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -727,7 +727,6 @@ native_irq_return_ldt:
pushq %rdi /* Stash user RDI */
swapgs /* to kernel GS */
SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi /* to kernel CR3 */
- UNTRAIN_RET

movq PER_CPU_VAR(espfix_waddr), %rdi
movq %rax, (0*8)(%rdi) /* user RAX */
--
2.31.1

2022-07-14 09:47:33

by Peter Zijlstra

Subject: Re: [PATCH] x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt

On Wed, Jul 13, 2022 at 09:58:08PM +0200, Alexandre Chartre wrote:
> UNTRAIN_RET is not needed in native_irq_return_ldt because ret untrain
> has already be done at this point. In addition, when the RETBleed
> mitigation is IBPB, UNTRAIN_RET clobbers several registers (AX, CX, DX)
> so here it trashes user values which are in these registers.
>
> Signed-off-by: Alexandre Chartre <[email protected]>

Acked-by: Peter Zijlstra (Intel) <[email protected]>

> ---
> arch/x86/entry/entry_64.S | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
> index 285e043a3e40..9953d966d124 100644
> --- a/arch/x86/entry/entry_64.S
> +++ b/arch/x86/entry/entry_64.S
> @@ -727,7 +727,6 @@ native_irq_return_ldt:
> pushq %rdi /* Stash user RDI */
> swapgs /* to kernel GS */
> SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi /* to kernel CR3 */
> - UNTRAIN_RET
>
> movq PER_CPU_VAR(espfix_waddr), %rdi
> movq %rax, (0*8)(%rdi) /* user RAX */
> --
> 2.31.1
>