linux-kernel - RE: [PATCH] arm64: turn off xgene branch prediction while in kernel space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <13f48247088a49b0a4a9afef0aa576a7@AcuMS.aculab.com>
Date:   Thu, 25 Jan 2018 12:44:34 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Will Deacon' <will.deacon@....com>,
        Mark Salter <msalter@...hat.com>
CC:     Marc Zyngier <marc.zyngier@....com>, Khuong Dinh <kdinh@....com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "catalin.marinas@....com" <catalin.marinas@....com>,
        "jcm@...hat.com" <jcm@...hat.com>,
        "lorenzo.pieralisi@....com" <lorenzo.pieralisi@....com>,
        "ard.biesheuvel@...aro.org" <ard.biesheuvel@...aro.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "christoffer.dall@...aro.org" <christoffer.dall@...aro.org>,
        "patches@....com" <patches@....com>
Subject: RE: [PATCH] arm64: turn off xgene branch prediction while in kernel
 space

From: Will Deacon
> Sent: 24 January 2018 16:43
> On Wed, Jan 24, 2018 at 11:35:03AM -0500, Mark Salter wrote:
> > On Wed, 2018-01-24 at 10:58 +0000, Marc Zyngier wrote:
> > > Khuong,
> > >
> > > On 24/01/18 02:13, Khuong Dinh wrote:
> > > > Aliasing attacks against CPU branch predictors can allow an attacker to
> > > > redirect speculative control flow on some CPUs and potentially divulge
> > > > information from one context to another.
> > > >
> > > > This patch only supports for XGene processors.
...
> > > Why isn't this using the infrastructure that is already in place?
> >
> > That infrastructure relies on a cpu-specific flush of the branch
> > predictor. XGene does not have the ability to flush the branch
> > predictor. It can only turn it on or off.
> 
> So how does this patch protect one user application from another? Sounds
> like you need to turn the thing off at boot and leave it that way, or find
> a sequence of branch instructions to effectively do the invalidation.

What sort of performance penalty does this give?
I can imagine it is significant.

Attempting to flush a branch predictor is also likely to be very slow.

	David