linux-kernel - Re: [PATCH v2 2/2] x86/bugs: Don't fill RSB on context switch with eIBRS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241206005300.b4uzyhtaabrrhrlx@jpoimboe>
Date: Thu, 5 Dec 2024 16:53:00 -0800
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: x86@...nel.org
Cc: linux-kernel@...r.kernel.org, amit@...nel.org, kvm@...r.kernel.org,
	amit.shah@....com, thomas.lendacky@....com, bp@...en8.de,
	tglx@...utronix.de, peterz@...radead.org,
	pawan.kumar.gupta@...ux.intel.com, corbet@....net, mingo@...hat.com,
	dave.hansen@...ux.intel.com, hpa@...or.com, seanjc@...gle.com,
	pbonzini@...hat.com, daniel.sneddon@...ux.intel.com,
	kai.huang@...el.com, sandipan.das@....com,
	boris.ostrovsky@...cle.com, Babu.Moger@....com,
	david.kaplan@....com, dwmw@...zon.co.uk, andrew.cooper3@...rix.com
Subject: Re: [PATCH v2 2/2] x86/bugs: Don't fill RSB on context switch with
 eIBRS

On Thu, Dec 05, 2024 at 03:32:47PM -0800, Josh Poimboeuf wrote:
> On Thu, Nov 21, 2024 at 12:07:19PM -0800, Josh Poimboeuf wrote:
> > User->user Spectre v2 attacks (including RSB) across context switches
> > are already mitigated by IBPB in cond_mitigation(), if enabled globally
> > or if either the prev or the next task has opted in to protection.  RSB
> > filling without IBPB serves no purpose for protecting user space, as
> > indirect branches are still vulnerable.
> 
> Question for Intel/AMD folks: where is it documented that IBPB clears
> the RSB?  I thought I'd seen this somewhere but I can't seem to find it.

For Intel, I found this:

  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

  "Software that executed before the IBPB command cannot control the
  predicted targets of indirect branches executed after the command on
  the same logical processor. The term indirect branch in this context
  includes near return instructions, so these predicted targets may come
  from the RSB.

  This article uses the term RSB-barrier to refer to either an IBPB
  command event, or (on processors which support enhanced IBRS) either a
  VM exit with IBRS set to 1 or setting IBRS to 1 after a VM exit."

I haven't seen anything that explicit for AMD.

-- 
Josh