linux-kernel - Re: [PATCH v2 2/2] x86/bugs: Don't fill RSB on context switch with eIBRS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241209204614.vzmb4dr3sfelcixk@jpoimboe>
Date: Mon, 9 Dec 2024 12:46:14 -0800
From: "jpoimboe@...nel.org" <jpoimboe@...nel.org>
To: "Shah, Amit" <Amit.Shah@....com>
Cc: "x86@...nel.org" <x86@...nel.org>, "corbet@....net" <corbet@....net>,
	"pawan.kumar.gupta@...ux.intel.com" <pawan.kumar.gupta@...ux.intel.com>,
	"kai.huang@...el.com" <kai.huang@...el.com>,
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"andrew.cooper3@...rix.com" <andrew.cooper3@...rix.com>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
	"Lendacky, Thomas" <Thomas.Lendacky@....com>,
	"daniel.sneddon@...ux.intel.com" <daniel.sneddon@...ux.intel.com>,
	"boris.ostrovsky@...cle.com" <boris.ostrovsky@...cle.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"seanjc@...gle.com" <seanjc@...gle.com>,
	"mingo@...hat.com" <mingo@...hat.com>,
	"pbonzini@...hat.com" <pbonzini@...hat.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>,
	"Moger, Babu" <Babu.Moger@....com>,
	"Das1, Sandipan" <Sandipan.Das@....com>,
	"dwmw@...zon.co.uk" <dwmw@...zon.co.uk>,
	"hpa@...or.com" <hpa@...or.com>,
	"peterz@...radead.org" <peterz@...radead.org>,
	"bp@...en8.de" <bp@...en8.de>,
	"Kaplan, David" <David.Kaplan@....com>
Subject: Re: [PATCH v2 2/2] x86/bugs: Don't fill RSB on context switch with
 eIBRS

On Fri, Dec 06, 2024 at 10:10:31AM +0000, Shah, Amit wrote:
> On Thu, 2024-12-05 at 15:32 -0800, Josh Poimboeuf wrote:
> > On Thu, Nov 21, 2024 at 12:07:19PM -0800, Josh Poimboeuf wrote:
> > > User->user Spectre v2 attacks (including RSB) across context
> > > switches
> > > are already mitigated by IBPB in cond_mitigation(), if enabled
> > > globally
> > > or if either the prev or the next task has opted in to protection. 
> > > RSB
> > > filling without IBPB serves no purpose for protecting user space,
> > > as
> > > indirect branches are still vulnerable.
> > 
> > Question for Intel/AMD folks: where is it documented that IBPB clears
> > the RSB?  I thought I'd seen this somewhere but I can't seem to find
> > it.
> 
> "AMD64 TECHNOLOGY INDIRECT BRANCH CONTROL EXTENSION"
> https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/white-papers/111006-architecture-guidelines-update-amd64-technology-indirect-branch-control-extension.pdf
> 
> has:
> 
> Indirect branch prediction barrier (IBPB) exists at MSR 0x49 (PRED_CMD)
> it 0. This is a write only MSR that both GP faults when software reads
> it or if software tries to write any of the bits in 63:1. When bit zero
> is written, the processor guarantees that older indirect branches
> cannot influence predictions of indirect branches in the future. This
> applies to jmp indirects, call indirects and returns. As this restricts
> the processor from using all previous indirect branch information, it
> is  intended to only be used by software when switching from one user
> context to another user context that requires protection, or from one
> guest to another guest.

Sounds like that needs to be updated to mention the IBPB_RET bit.

-- 
Josh