linux-kernel - RE: [RFC] x86_64: A real proposal for iret-less return to kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 May 2014 22:32:53 +0000
From:	"Luck, Tony" <tony.luck@...el.com>
To:	Andy Lutomirski <luto@...capital.net>
CC:	Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>,
	"Thomas Gleixner" <tglx@...utronix.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	"Andi Kleen" <andi@...stfloor.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...nel.org>
Subject: RE: [RFC] x86_64: A real proposal for iret-less return to kernel

>> The recovery path has to do more than just send a signal - it needs to walk processes and
>> "mm"s to see which have mapped the physical address that the h/w told us has gone bad.
>
> I still feel like I'm missing something.  If we interrupted user space
> code, then the context we're in should be identical to the context
> we'll get when we're about to return to userspace.

True. And this far along in do_machine_check() we have set all the other cpus
free, so the are heading back to whatever context we interrupted them in. So
we might be able to do all that other stuff inline here ... we interrupted user
mode, so we know we don't hold any locks. Other cpus are running, so they can
complete what they are doing to release any locks we might need.

But it will take a while (to scan all those processes). And we haven't yet
cleared MCG_STATUS ... so another machine check before we do that
would be fatal (x86 doesn't allow nesting).  Even if we moved the work
after the clear of MCG_STATUS we'd still be vulnerable to a new machine
check on x86_64 because we are sitting on the one & only machine check
stack.

-Tony