linux-kernel - Re: [PATCH] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1801301349140.1797@nanos>
Date:   Tue, 30 Jan 2018 13:57:21 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     David Woodhouse <dwmw2@...radead.org>
cc:     Borislav Petkov <bp@...en8.de>, arjan@...ux.intel.com,
        karahmed@...zon.de, x86@...nel.org, linux-kernel@...r.kernel.org,
        tim.c.chen@...ux.intel.com, peterz@...radead.org,
        pbonzini@...hat.com, ak@...ux.intel.com,
        torvalds@...ux-foundation.org, gregkh@...ux-foundation.org
Subject: Re: [PATCH] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits
 on Intel

On Tue, 30 Jan 2018, David Woodhouse wrote:

> On Tue, 2018-01-30 at 12:37 +0100, Thomas Gleixner wrote:
> 
> > In any case, if there is ucode mismatch between CPUs the whole thing is
> > hosed anyway no matter what. So can you please agree on a solution so we
> > can unbreak the current state of affairs?
> 
> If there is µcode mismatch between CPUs then the inconsistent bits
> should be filtered down to the lowest common denominator and we
> shouldn't use the features that are not consistently present. That much
> ought to work already with my patch.
> 
> Boris's version uses setup_force_cpu_cap() and forces the bit to be set
> even on secondary CPUs which don't really have it, and thus it won't
> get filtered out. We'll try to use it, and it will fault on the CPUs
> which don't have it.

So much for the theory. That's not going to work. If the boot cpu has the
feature then the alternatives will have been applied. So even if the flag
mismatch can be observed when a secondary CPU comes up the outcome will be
access to a non existing MSR and #GP.

The whole per cpu feature flag magic in x86 is just an empty shell
providing the illusion of supporting heterogenous systems. If that "works" in
a particular constellation then by pure chance and not by design.

All you can reasonably do is to detect the mismatch once the CPU is brought
up and then immediately aborting the hotplug operation _before_ it has the
chance to touch anything. But that does not necessarily require per cpu
storage.

Thanks,

	tglx