linux-kernel - Re: [PATCH] x86/retpoline: Fill return stack buffer on vmexit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 11 Jan 2018 18:34:32 -0600
From:   Tom Lendacky <thomas.lendacky@....com>
To:     David Woodhouse <dwmw2@...radead.org>,
        Andi Kleen <ak@...ux.intel.com>
Cc:     Paul Turner <pjt@...gle.com>, LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...ux-foundation.org>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>, tglx@...utronix.de,
        Kees Cook <keescook@...gle.com>,
        Rik van Riel <riel@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...capital.net>,
        Jiri Kosina <jikos@...nel.org>, gnomes@...rguk.ukuu.org.uk,
        x86@...nel.org, bp@...en8.de, rga@...zon.de
Subject: Re: [PATCH] x86/retpoline: Fill return stack buffer on vmexit

On 1/10/2018 6:14 PM, Tom Lendacky wrote:
> On 1/10/2018 5:47 PM, David Woodhouse wrote:
>> On Wed, 2018-01-10 at 22:51 +0000, David Woodhouse wrote:
>>> In accordance with the Intel and AMD documentation, we need to overwrite
>>> all entries in the RSB on exiting a guest, to prevent malicious branch
>>> target predictions from affecting the host kernel. This is needed both
>>> for retpoline and for IBRS.
>>>
>>> Signed-off-by: David Woodhouse <dwmw@...zon.co.uk>
>>> ---
>>> Untested in this form although it's a variant on what we've had already.
>>> I have an army of machines willing to do my bidding but nested virt
>>> is non-trivial and I figure I might as well post it as someone else
>>> can probably test it in less than the time it takes me to work out how.
>>
>> Now smoke tested with Intel VT-x, but not yet on AMD. Tom, would you be
>> able to do that?
> 
> Yes, I'll try to get to it as soon as I can, but it might be tomorrow
> (morning).

Sorry for the delay.  This is working on my system for normal virt, but is
failing with nested virt.  However, it does not appear that this patch is
the problem.  I've gone back to commit 8d56eff266f3 in the x86/pti tree
(before retpoline, etc.) and nested virt is still broke.  Not sure how
much time I want to spend digging through this since nested virt on
4.15-rc7 works.

Thanks,
Tom

> 
> Thanks,
> Tom
> 
>>
>>
>>> This implements the most pressing of the RSB stuffing documented
>>> by dhansen (based our discussions) in https://goo.gl/pXbvBE