Re: [patch V6 07/14] MDS basics 7

On Sat, 2 Mar 2019, speck for Frederic Weisbecker wrote:

> On Fri, Mar 01, 2019 at 10:47:45PM +0100, speck for Thomas Gleixner wrote:
> > +
> > +   - Debug Exception (#DB):
> > +
> > +     This takes the paranoid exit path only when the INT1 breakpoint is in
> > +     kernel space. #DB on a user space address takes the regular exit path,
> > +     so no extra mitigation required.
> 
> I can't find that part in this patch, maybe it's further in the series?

There is no patch. #DB is not interesting as explained above.

> > --- a/arch/x86/kernel/nmi.c
> > +++ b/arch/x86/kernel/nmi.c
> > @@ -34,6 +34,7 @@
> >  #include <asm/x86_init.h>
> >  #include <asm/reboot.h>
> >  #include <asm/cache.h>
> > +#include <asm/nospec-branch.h>
> >  
> >  #define CREATE_TRACE_POINTS
> >  #include <trace/events/nmi.h>
> > @@ -533,6 +534,9 @@ do_nmi(struct pt_regs *regs, long error_
> >  		write_cr2(this_cpu_read(nmi_cr2));
> >  	if (this_cpu_dec_return(nmi_state))
> >  		goto nmi_restart;
> > +
> > +	if (user_mode(regs))
> > +		mds_user_clear_cpu_buffers();
> 
> What if the NMI fires after a call to prepare_exit_to_usermode()
> but before the actual return to usermode, would that be a problem?

Yes, it's a hole in the protection, but you would need to be able to
orchestrate that as user which I doubt you can. So the thought was that we
rather avoid the penalty for perf when it hits kernel space, which requires
root ....

Thanks,

	tglx