| From foo@baz Tue Aug 14 16:14:56 CEST 2018 |
| From: Andi Kleen <ak@linux.intel.com> |
| Date: Wed, 13 Jun 2018 15:48:25 -0700 |
| Subject: x86/speculation/l1tf: Make sure the first page is always reserved |
| |
| From: Andi Kleen <ak@linux.intel.com> |
| |
| commit 10a70416e1f067f6c4efda6ffd8ea96002ac4223 upstream |
| |
| The L1TF workaround doesn't make any attempt to mitigate speculate accesses |
| to the first physical page for zeroed PTEs. Normally it only contains some |
| data from the early real mode BIOS. |
| |
| It's not entirely clear that the first page is reserved in all |
| configurations, so add an extra reservation call to make sure it is really |
| reserved. In most configurations (e.g. with the standard reservations) |
| it's likely a nop. |
| |
| Signed-off-by: Andi Kleen <ak@linux.intel.com> |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com> |
| Acked-by: Dave Hansen <dave.hansen@intel.com> |
| Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/x86/kernel/setup.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/arch/x86/kernel/setup.c |
| +++ b/arch/x86/kernel/setup.c |
| @@ -854,6 +854,12 @@ void __init setup_arch(char **cmdline_p) |
| memblock_reserve(__pa_symbol(_text), |
| (unsigned long)__bss_stop - (unsigned long)_text); |
| |
| + /* |
| + * Make sure page 0 is always reserved because on systems with |
| + * L1TF its contents can be leaked to user processes. |
| + */ |
| + memblock_reserve(0, PAGE_SIZE); |
| + |
| early_reserve_initrd(); |
| |
| /* |
