linux-kernel - Re: [PATCH RESEND] x86/speculation: Fix user-mode spectre-v2 protection with KERNEL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50231372-2d6d-e4af-be88-5fe45e0c210d@citrix.com>
Date:   Mon, 20 Feb 2023 23:30:46 +0000
From:   Andrew Cooper <andrew.cooper3@...rix.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     KP Singh <kpsingh@...nel.org>, Dave Hansen <dave.hansen@...el.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        linux-kernel@...r.kernel.org, pjt@...gle.com, evn@...gle.com,
        tglx@...utronix.de, mingo@...hat.com, dave.hansen@...ux.intel.com,
        x86@...nel.org, hpa@...or.com, peterz@...radead.org,
        pawan.kumar.gupta@...ux.intel.com, kim.phillips@....com,
        alexandre.chartre@...cle.com, daniel.sneddon@...ux.intel.com,
        José Oliveira <joseloliveira11@...il.com>,
        Rodrigo Branco <rodrigo@...nelhacking.com>,
        Alexandra Sandulescu <aesa@...gle.com>,
        Jim Mattson <jmattson@...gle.com>
Subject: Re: [PATCH RESEND] x86/speculation: Fix user-mode spectre-v2
 protection with KERNEL_IBRS

On 20/02/2023 9:10 pm, Borislav Petkov wrote:
> On Mon, Feb 20, 2023 at 07:57:25PM +0000, Andrew Cooper wrote:
>> I think we're discussing the legacy IBRS case here.  i.e. what was
>> retrofitted in microcode for existing parts?
> Any IBRS actually. The one which is *not* the automatic, fire'n'forget
> thing.

/sigh so we're still talking about 3 different things then.

1) Intel's legacy IBRS
2) AMD's regular IBRS
3) AMD's AutoIBRS

which all have different relevant behaviours for userspace.  Just so
it's written out coherently in at least one place...

When SEV-SNP is enabled in firmware, whether or not it's being used by
software, AutoIBRS keeps indirect predictions inhibited in all of
ASID0.  That's all host userspace to the non-hypervisor devs reading
this thread.

For any AMD configuration setting STIBP, there must be an IBPB after
having set STIBP.   Setting STIBP alone does not evict previously
created shared predictions.  This one can go subtly wrong for anyone who
assumes that Intel STIBP and AMD STIBP have the same behaviour.

Furthermore, extra care needs taking on vmexit because transitioning
from the guest STIBP setting to the host STIBP setting can leave shared
predictions intact.

~Andrew