linux-kernel - Re: [PATCH v2] x86/cpu: Fix migration safety with X86_BUG_NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Oct 2021 21:18:53 +0100
From:   Andrew Cooper <andrew.cooper3@...rix.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Borislav Petkov <bp@...en8.de>
CC:     Jane Malalane <jane.malalane@...rix.com>,
        LKML <linux-kernel@...r.kernel.org>, <x86@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, Pu Wen <puwen@...on.cn>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Yazen Ghannam <Yazen.Ghannam@....com>,
        Brijesh Singh <brijesh.singh@....com>,
        Huang Rui <ray.huang@....com>,
        Andy Lutomirski <luto@...nel.org>,
        Kim Phillips <kim.phillips@....com>, <stable@...r.kernel.org>
Subject: Re: [PATCH v2] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL

On 18/10/2021 21:05, Sean Christopherson wrote:
> On Mon, Oct 18, 2021, Borislav Petkov wrote:
>> On Mon, Oct 18, 2021 at 07:29:41PM +0000, Sean Christopherson wrote:
>>> I agree.  If the argument for this patch is that the kernel can be migrated to
>>> older hardware, then it stands to reason that the kernel could also be migrated
>>> to a different CPU vendor entirely.  E.g. start on Intel, migrate to Zen1, kaboom.
>> Migration across vendors? Really, that works?
>>
>> I'll believe it only when I see it with my own eyes.
> There are plenty of caveats, but it is feasible.  KVM even has a few patches that
> came about specifically to support cross-vendor migration, e.g. commit adc2a23734ac
> ("KVM: nSVM: improve SYSENTER emulation on AMD").

http://developer.amd.com/wordpress/media/2012/10/CrossVendorMigration.pdf

Yeah - it really did work back in the day.  For Xen PV guests, it still
largely works today, because the most obvious vendor specifics were
already abstracted away in the PV ABI.

Of course, none of this has remotely survived the speculation
apocalypse.  A cross-vendor VM has 0 chance of getting speculation
safety working.

~Andrew