linux-kernel - Re: [Patch v5 11/16] x86/speculation: Add Spectre v2 app to app protection modes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Nov 2018 01:00:18 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Jiri Kosina <jikos@...nel.org>
cc:     Tim Chen <tim.c.chen@...ux.intel.com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Andi Kleen <ak@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Casey Schaufler <casey.schaufler@...el.com>,
        Asit Mallick <asit.k.mallick@...el.com>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Jon Masters <jcm@...hat.com>,
        Waiman Long <longman9394@...il.com>,
        linux-kernel@...r.kernel.org, x86@...nel.org
Subject: Re: [Patch v5 11/16] x86/speculation: Add Spectre v2 app to app
 protection modes

On Tue, 20 Nov 2018, Jiri Kosina wrote:

> On Tue, 20 Nov 2018, Thomas Gleixner wrote:
> 
> > What? IBPB makes tons of sense even without STIBP.
> 
> On non-SMT, yes. But this patchset ties those two the other (sensible) way 
> around AFAICS ("STIBP iff (IBPB && SMT)").

Errm. No.

The patches disable IBPB if STIBP is not available and that has absolutely
nothing to do with SMT simply because the static key controlling IBPB is
only flipped on when both IBPB and STIBP are available.

For SMT=off STIBP is pointless, but IBPB still makes a lot of sense.

That's a change which is neither documented nor correct.

Thanks,

	tglx