linux-kernel - Re: [PATCH 2/2] x86/bugs: Don't fill RSB on context switch with eIBRS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a3242e93ab2b38fb3279af01472c14bcdf9766d8.camel@amd.com>
Date: Thu, 21 Nov 2024 13:28:18 +0000
From: "Shah, Amit" <Amit.Shah@....com>
To: "jpoimboe@...nel.org" <jpoimboe@...nel.org>
CC: "corbet@....net" <corbet@....net>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "kai.huang@...el.com" <kai.huang@...el.com>,
	"boris.ostrovsky@...cle.com" <boris.ostrovsky@...cle.com>,
	"andrew.cooper3@...rix.com" <andrew.cooper3@...rix.com>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "Lendacky,
 Thomas" <Thomas.Lendacky@....com>, "daniel.sneddon@...ux.intel.com"
	<daniel.sneddon@...ux.intel.com>, "pawan.kumar.gupta@...ux.intel.com"
	<pawan.kumar.gupta@...ux.intel.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "seanjc@...gle.com" <seanjc@...gle.com>,
	"mingo@...hat.com" <mingo@...hat.com>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "tglx@...utronix.de" <tglx@...utronix.de>, "Moger,
 Babu" <Babu.Moger@....com>, "Phillips, Kim" <kim.phillips@....com>, "Das1,
 Sandipan" <Sandipan.Das@....com>, "dwmw@...zon.co.uk" <dwmw@...zon.co.uk>,
	"amit@...nel.org" <amit@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
	"peterz@...radead.org" <peterz@...radead.org>, "bp@...en8.de" <bp@...en8.de>,
	"Kaplan, David" <David.Kaplan@....com>, "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH 2/2] x86/bugs: Don't fill RSB on context switch with eIBRS

On Wed, 2024-11-20 at 08:21 -0800, jpoimboe@...nel.org wrote:
> On Wed, Nov 20, 2024 at 10:27:42AM +0000, Shah, Amit wrote:
> > On Tue, 2024-11-19 at 23:27 -0800, Josh Poimboeuf wrote:
> > > User->user Spectre v2 attacks (including RSB) across context
> > > switches
> > > are already mitigated by IBPB in cond_mitigation(), if enabled
> > > globally
> > > or if at least one of the tasks has opted in to protection.  RSB
> > > filling
> > > without IBPB serves no purpose for protecting user space, as
> > > indirect
> > > branches are still vulnerable.
> > > 
> > > User->kernel RSB attacks are mitigated by eIBRS.  In which case
> > > the
> > > RSB
> > > filling on context switch isn't needed.  Fix that.
> > > 
> > > While at it, update and coalesce the comments describing the
> > > various
> > > RSB
> > > mitigations.
> > 
> > Looks good from first impressions - but there's something that
> > needs
> > some deeper analysis: AMD's Automatic IBRS piggybacks on eIBRS, and
> > has
> > some special cases.  Adding Kim to CC to check and confirm if
> > everything's still as expected.
> 
> FWIW, so "Technical Guidance for Mitigating Branch Type Confusion"
> has
> the following:
> 
>   Finally, branches that are predicted as ‘ret’ instructions get
> their
>   predicted targets from the Return Address Predictor (RAP). AMD
>   recommends software use a RAP stuffing sequence (mitigation V2-3 in
>   [2]) and/or Supervisor Mode Execution Protection (SMEP) to ensure
> that
>   the addresses in the RAP are safe for speculation. Collectively, we
>   refer to these mitigations as “RAP Protection”.
> 
> So it sounds like user->kernel RAP poisoning is mitigated by SMEP on
> AMD.

It indeed is. I'm just asking Kim to confirm whether the AutoIBRS
workflow can be updated based on this rework -- esp with disabling it
for SEV-SNP hosts.  I just went through those patches, and it doesn't
look like anything needs changing.

		Amit